CVE-2026-72604
Intelliants Subrion CMS - Path Traversal
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.
| CWE | CWE-22 |
| Vendor | intelliants |
| Product | subrion cms |
| Published | Aug 11, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for intelliants subrion cms
Be the first to know when new medium vulnerabilities affecting intelliants subrion cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Intelliants / Subrion CMS
0 ≤ 4.2.1
Credits
Qobiljon Oblaqulov