CVE-2026-108568 is a medium severity vulnerability in InstantSoft icms2 versions 2.18.0, 2.18.1, and 2.18.2. It involves insufficient verification of data authenticity in the validatePaypalOrder function of the Billing Module, specifically in the paypal.php controller. The flaw allows remote attackers to manipulate the bid/sig arguments, potentially bypassing data validation. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
CVE-2026-108567 is a path traversal vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. It occurs in the files_delete_file function within the Image Handler component, allowing remote attackers to manipulate the size argument to traverse directories. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit 03d70937f1ff97031523222808726994b8b79379 is available to fix this issue.
CVE-2026-108566 is a cross-site scripting (XSS) vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. The flaw exists in the Private Message Handler component, specifically in the index function of templates/default/controllers/messages/index.tpl.php, where manipulation of the 'nickname' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available to address this issue. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
InstantCMS is a free and open source content management system. A blind Server-Side Request Forgery (SSRF) vulnerability in InstantCMS up to and including 2.17.3 allows authenticated remote attackers to make nay HTTP/HTTPS request via the package parameter. It is possible to make any HTTP/HTTPS request to any website in installer functionality. Due to such vulnerability it is possible to for example scan local network, call local services and its functions, conduct a DoS attack, and/or disclose a server's real IP if it's behind a reverse proxy. It is also possible to exhaust server resources by sending plethora of such requests. As of time of publication, no patched releases are available.