CVE-2026-108567: InstantSoft icms2 Image image.php files_delete_file path traversal
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function filesdeletefile of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InstantSoft icms2to a version that resolves this vulnerability.Patch 03d70937f1ff97031523222808726994b8b79379
Event History
Frequently Asked Questions
Which deployments are affected?
InstantSoft icms2 versions up to and including 2.18.2 are affected, specifically the Image Handler component's files_delete_file function in system/fields/image.php.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and uses manipulation of the size argument to trigger path traversal. The supplied data does not specify any authentication or user-interaction requirement.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
What should be done to remediate the issue?
Apply the vendor patch identified as 03d70937f1ff97031523222808726994b8b79379. The provided information does not describe a workaround if patching cannot be performed immediately.