InstantCMS 2 EUVD-2026-96870

Requires an authenticated session with at least low privileges (CVSS PR:L) on an InstantSoft icms2 instance at version 2.18.2 or earlier, plus the ability to reach the image/file handling feature (Image Handler) that invokes files_delete_file. The concrete prerequisite is attacker control over the 'size' argument, into which path-traversal sequences are injected; no user interaction is required (UI:N). Limiting factors: exploitation is gated by valid authentication (not anonymous), impact is confined to availability (file deletion) with no confidentiality or integrity gain per the vector, and the issue is fixed in the patched build, so patched or non-vulnerable versions are not exploitable.

This is a moderate, not urgent, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw but explicitly requires PR:L - an authenticated account with at least low privileges - which materially limits the attacker population to registered/logged-in users of the icms2 site rather than anonymous internet traffic. Impact is narrow: the vector sets VC:N/VI:N and only VA:L (low availability impact, no confidentiality or integrity loss claimed), consistent with a file-deletion path traversal that can disrupt files but is not scored as code execution or data theft. The E:P subscore and the description ('the exploit has been made public') confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation - POC availability and active exploitation are distinct signals and only the former is present here. One notable conflict to flag: the description attributes the bug to files_delete_file in system/fields/image.php (the Image Handler) via a 'size' argument, yet the referenced patch commit modifies upload/MIME-validation logic in system/core/uploader.php, system/core/uploadfile.php and system/fields/file.php, not a delete routine in image.php - verify the true root cause and fix scope with the vendor. Net: a real-but-low-urgency issue gated by authentication and limited impact, where public POC raises the floor for opportunistic abuse by authenticated users but low prevalence and no KEV keep it well below critical.

An authenticated low-privilege icms2 user submits a crafted request to the image/file handling feature, manipulating the 'size' argument with path-traversal sequences (e.g. ../../) so the files_delete_file operation resolves outside the intended upload directory. A public proof-of-concept exists, so the attacker deletes server files they should not be able to reach, causing availability disruption. Because the CVSS vector is AV:N/AC:L, the request can be sent remotely over the network with low effort once a valid session is held.