What is the CVSS score of CVE-2026-72604?

CVE-2026-72604 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Subrion CMS CVE-2026-72604

EUVD-2026-56043 MEDIUM

Path Traversal (CWE-22)

2026-08-11 TuranSec

GHSA-fgfw-7r72-25m2

Path Traversal Subrion Cms Intelliants

6.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

6.5 MEDIUM

Administrator authentication strictly required; file deletion yields high integrity and availability impact but no confidentiality exposure, with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:28 vuln.today

DescriptionCVE.org

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.

AnalysisAI

Arbitrary file deletion in Subrion CMS through 4.2.1 is enabled by the admin panel file deletion endpoint passing user-supplied paths directly to PHP's unlink() function without sanitization or path canonicalization, allowing directory traversal outside the web root. Authenticated administrators on affected instances can delete sensitive system files, risking server instability, loss of critical configuration, or creating conditions for follow-on privilege escalation. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

Subrion CMS is a PHP-based content management system developed by Intelliants, with source code hosted at https://github.com/intelliants/subrion. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the admin panel's file deletion endpoint accepts a user-supplied file path and passes it directly to PHP's native unlink() function without invoking realpath() for canonicalization, stripping traversal sequences (../), or validating that the resolved path falls within an allowed directory boundary. An attacker can craft a path such as ../../../../etc/cron.d/job or ../../../../var/www/html/config.php to reference and delete files anywhere the web server process has write permissions. The CPE string cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:* confirms all versions through 4.2.1 are within scope per EUVD-2026-56043.

RemediationAI

No vendor-released patch has been identified at time of analysis; the sole reference points to the upstream GitHub repository at https://github.com/intelliants/subrion without citing a specific tagged release or security advisory. Administrators should monitor that repository for a patched version and upgrade as soon as one is confirmed. In the interim, restrict network access to the Subrion admin panel using firewall rules or web server ACLs (e.g., nginx allow/deny or Apache mod_authz_host) so that only trusted IP ranges can reach the admin interface, substantially reducing the attack surface even if credentials are compromised. Enforce multi-factor authentication and strong unique passwords for all administrator accounts to raise the credential-theft bar. Run the web server process under an OS user account with file system permissions scoped to the web root and necessary writable directories only, so that even if unlink() is invoked with a traversal path, the OS-level permission boundary prevents deletion of out-of-scope files. Enable and review server-side file system audit logs (e.g., auditd on Linux) to detect anomalous deletion activity. These mitigations do not eliminate the vulnerability but substantially reduce exploit feasibility and blast radius.