Qobiljon Oblaqulov

**Name of the Vulnerable Software and Affected Versions** Intelliants Subrion CMS versions prior to 4.2.2 **Description** An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file path directly to the `unlink()` function without sanitization or path canonicalization. Path canonicalization is the process of converting a file path to its simplest, standard form to prevent bypasses. This flaw allows the deletion of sensitive system files outside the web root, which may lead to server instability or facilitate further attacks. **Recommendations** Update Intelliants Subrion CMS to version 4.2.2 or later.