CVE-2026-72604

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2

Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file path directly to the unlink() function without sanitization or path canonicalization. Path canonicalization is the process of converting a file path to its simplest, standard form to prevent bypasses. This flaw allows the deletion of sensitive system files outside the web root, which may lead to server instability or facilitate further attacks.

Recommendations Update Intelliants Subrion CMS to version 4.2.2 or later.