Threats affecting pkg:github/instantsoft/icms2

CVE-2026-108567 is a path traversal vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. It occurs in the files_delete_file function within the Image Handler component, allowing remote attackers to manipulate the size argument to traverse directories. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit 03d70937f1ff97031523222808726994b8b79379 is available to fix this issue.

CVE-2026-108566 is a cross-site scripting (XSS) vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. The flaw exists in the Private Message Handler component, specifically in the index function of templates/default/controllers/messages/index.tpl.php, where manipulation of the 'nickname' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available to address this issue. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.