CVE-2026-108566: Cross Site Scripting in InstantSoft icms2

This vulnerability in InstantSoft icms2 up to version 2.18.2 involves improper sanitization or validation of the nickname parameter in the Private Message Handler's index function, leading to cross-site scripting (XSS). An attacker can remotely exploit this flaw by injecting malicious scripts via the nickname argument, potentially affecting users who view the crafted messages. The vulnerability has been publicly disclosed, and a patch is available under the commit identifier 3a1ec8fcb073a46d06a2ab83bc2bf68225834281.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the scope of the XSS vulnerability and requires user interaction (UI:P). The vulnerability does not require privileges beyond low-level user access and has no known impact on confidentiality, integrity, or availability beyond the client-side scripting context.

A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available and should be applied to affected versions 2.18.0, 2.18.1, and 2.18.2 to remediate this vulnerability. Applying this official fix is the recommended mitigation. No vendor advisory content was provided to indicate otherwise.