Medium severity · published Oct 11, 2026
CVE-2026-108567
InstantSoft icms2 Image image.php files_delete_file path traversal
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the component Image Handler. Performing a manipulation of the argument size results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The patch is named 03d70937f1ff97031523222808726994b8b79379. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
icms2 · InstantSoft
2.18.0; 2.18.1; 2.18.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108567
vdb-entry
https://vuldb.com/vuln/416224
signature
https://vuldb.com/vuln/416224/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-108567
third-party-advisory
https://vuldb.com/submit/954260
patch
https://github.com/instantsoft/icms2/commit/03d70937f1ff97031523222808726994b8b79379
product
https://github.com/instantsoft/icms2/
More from icms2
7.2
CVE-2025-59055
InstantCMS vulnerable to Server-Side Request Forgery via package installer
7.2
CVE-2024-31212
SQL injection in index_chart_data action
7.1
CVE-2026-28281
InstantCMS has Multiple CSRF Vulnerabilities
5.5
CVE-2026-54611
InstantCMS has Remote Code Execution in package installer
5.4
CVE-2024-50348
InstantCMS has a Cross Site Scripting Vulnerability