A vulnerability was found in InstantSoft icms2 up to 2.18.2. (CVE-2026-108567)

CVE-2026-108567 describes a path traversal vulnerability in InstantSoft icms2 versions up to 2.18.2. The flaw is located in the files_delete_file function within the system/fields/image.php file of the Image Handler component. By manipulating the 'size' argument, an attacker can perform path traversal attacks remotely. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact affects availability only, with no confidentiality or integrity impact. A patch identified by commit 03d70937f1ff97031523222808726994b8b79379 is recommended to remediate the issue.

The vulnerability allows remote attackers with low privileges to cause availability disruption via path traversal in the image deletion function. There is no impact on confidentiality or integrity. The exploit has been publicly disclosed but no known active exploitation in the wild has been reported.

Apply the patch identified by commit 03d70937f1ff97031523222808726994b8b79379 to fix the path traversal vulnerability in the files_delete_file function. No other mitigations are specified. Patch status is confirmed by the presence of the patch commit.