CVE-2026-72604 in Subrion CMS
Summary
by MITRE • 08/11/2026
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical path traversal flaw in Intelliants Subrion CMS version 4.2.1 and earlier, where authenticated administrative users can exploit a direct file deletion endpoint to remove arbitrary files from the server filesystem. The security weakness stems from improper input validation and sanitization within the admin panel's file management functionality, specifically when processing user-supplied file paths for deletion operations. The vulnerability manifests when the application passes unvalidated file path parameters directly to the unlink() system function without proper canonicalization or path validation mechanisms.
The technical implementation of this flaw involves a classic path traversal attack vector where administrative users can manipulate file path inputs to access files outside the intended web root directory boundaries. This occurs because the application fails to implement proper path normalization and validation checks before executing filesystem operations. The vulnerability is particularly dangerous as it operates within the privileged administrative context, meaning that any authenticated administrator with access to the admin panel can leverage this flaw to delete critical system files, configuration files, or even executable components that could compromise server stability and security posture.
From an operational impact perspective, this vulnerability creates significant risk for affected systems as it allows attackers with administrative credentials to potentially destabilize servers by deleting essential system files, database configuration files, or application binaries. The ability to remove files outside the web root directory means that attackers can target not just web content but also underlying system components that could lead to complete service disruption or provide footholds for further exploitation. This vulnerability directly maps to CWE-22 Path Traversal and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables arbitrary code execution through file manipulation.
The attack surface is particularly concerning because the vulnerability requires only administrative access, which suggests that an attacker who has already compromised administrative credentials or gained access to a legitimate administrative account can immediately exploit this weakness. Organizations with Subrion CMS installations should urgently implement mitigations including input validation for all file path parameters, implementing proper path canonicalization before filesystem operations, and restricting administrative file deletion capabilities to prevent access outside designated directories. Additionally, organizations should consider implementing additional security controls such as file integrity monitoring, privileged access management, and regular security assessments to detect and prevent exploitation of similar vulnerabilities in their infrastructure.
This vulnerability demonstrates the critical importance of proper input validation in web applications and highlights how seemingly simple functions like file deletion can become attack vectors when proper security measures are not implemented. The flaw represents a failure in the principle of least privilege and proper access control enforcement, allowing administrative users to operate outside their intended scope of file system access. Organizations should also consider implementing automated vulnerability scanning tools that can detect such path traversal vulnerabilities in their web applications and ensure that all file system operations are properly validated and sanitized before execution. The remediation process should include comprehensive code review of all file handling functions and implementation of secure coding practices that prevent direct user input from being passed to system-level filesystem functions without proper validation and sanitization.