A vulnerability has been found in InstantSoft icms2 up to 2.18.2. (CVE-2026-108566)
Description
A cross-site scripting (XSS) vulnerability exists in InstantSoft icms2 up to version 2.18.2 in the Private Message Handler component. The vulnerability is due to improper handling of the nickname argument in the index.tpl.php file. This flaw can be exploited remotely and has been publicly disclosed. The vulnerability has a low severity rating with a CVSS score of 3.5. A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available to address this issue. It is recommended to apply this patch to mitigate the vulnerability.
CVSS v3.1
Score 3.5low
Affected software
pkg:github/instantsoft/icms2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
InstantSoft icms2 versions up to 2.18.2 contain a cross-site scripting vulnerability in the Private Message Handler component, specifically in the index.tpl.php template file. The vulnerability arises from manipulation of the nickname argument, allowing an attacker to inject malicious scripts. The vulnerability is remotely exploitable and has been publicly disclosed. The patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 resolves this issue.
Potential Impact
The vulnerability allows an attacker to perform cross-site scripting attacks by manipulating the nickname argument in the affected component. This can lead to limited impact such as injection of malicious scripts that may affect user interaction or session integrity. The CVSS score of 3.5 and low severity rating reflect the limited impact, with no confidentiality or availability impact reported.
Mitigation Recommendations
A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available and should be applied to affected versions to remediate this vulnerability. Applying this patch is the recommended and best practice mitigation. No vendor advisory was provided to indicate otherwise.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j944-2cmv-5vxf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108566"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acc00a62cdf04f656fed60f
Added to database: 10/11/2026, 21:33:26 UTC
Last enriched: 10/11/2026, 21:46:26 UTC
Last updated: 10/12/2026, 03:48:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.