Vulnerability · Published Oct 11, 2026 · Assigned by VulDB

CVE-2026-108567InstantSoft icms2 Image image.php files_delete_file path traversal

Medium 4.3

In plain English

A medium-severity path traversal in icms2 from InstantSoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
InstantSoft	icms2	2.18.02.18.12.18.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-416224 | InstantSoft icms2 Image image.php files_delete_file path traversal vdb-entry, technical-description
VDB-416224 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-108567 | CVE Analysis and Report third-party-advisory
Submit #954260 | InstantCMS InstantCMS icms2 2.18.2 Improper Access Controls third-party-advisory
https://github.com/instantsoft/icms2/commit/03d70937f1ff97031523222808726994b8b79379 patch
https://github.com/instantsoft/icms2/ product