CVE-2026-108567

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.3

Description A path traversal issue exists in the Image Handler component within the files delete file() function of the system/fields/image.php file. A remote attacker can exploit this by manipulating the size argument, allowing them to access or delete files outside the intended directory.

Recommendations Apply patch 03d70937f1ff97031523222808726994b8b79379 to versions prior to 2.18.3. As a temporary mitigation, restrict access to the files delete file() function in the system/fields/image.php file.