CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/intelliants/subrion

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta en Intelliants Subrion CMS hasta la versión 4.2.1 permite a los administradores autenticados eliminar archivos arbitrarios en el servidor a través del endpoint de eliminación de archivos del panel de administración. El endpoint pasa una ruta de archivo proporcionada por el usuario directamente a unlink() sin saneamiento ni canonización de ruta. Un administrador autenticado puede eliminar archivos de sistema sensibles fuera de la raíz web, lo que podría causar inestabilidad del servidor o facilitar ataques adicionales.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72604

Mitre link : CVE-2026-72604

CVE.ORG link : CVE-2026-72604

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-72604", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72604", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:11:37.421617Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Intelliants", "product": "Subrion CMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.2.1"}]}]}], "published": "2026-08-11T12:17:43.507", "references": [{"url": "https://github.com/intelliants/subrion", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en Intelliants Subrion CMS hasta la versi\u00f3n 4.2.1 permite a los administradores autenticados eliminar archivos arbitrarios en el servidor a trav\u00e9s del endpoint de eliminaci\u00f3n de archivos del panel de administraci\u00f3n. El endpoint pasa una ruta de archivo proporcionada por el usuario directamente a unlink() sin saneamiento ni canonizaci\u00f3n de ruta. Un administrador autenticado puede eliminar archivos de sistema sensibles fuera de la ra\u00edz web, lo que podr\u00eda causar inestabilidad del servidor o facilitar ataques adicionales."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}