This vulnerability (CWE-22) exists in Intelliants Subrion CMS through version 4.2.1. Authenticated administrators can exploit a path traversal flaw in the admin panel's file deletion endpoint by supplying crafted file paths. The endpoint does not sanitize or canonicalize the input before passing it to unlink(), allowing deletion of arbitrary files on the server filesystem, including those outside the intended directory scope. This can disrupt server operations or facilitate additional malicious activities.

An authenticated administrator can delete arbitrary files on the server, including sensitive system files outside the web root. This can cause server instability or create conditions favorable for further attacks. The CVSS score of 6.5 (medium severity) reflects the potential for high impact on integrity and availability, but requires administrator privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious file deletion activity. Avoid using affected versions in production environments if possible.