CVE-2026-96824 in Template Kit Plugin
Summary
by MITRE • 09/30/2026
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an arbitrary file deletion flaw within the Editor component of the Template Kit plugin, specifically affecting versions up to and including 1.0.16, represents a critical security risk that compromises the integrity of web server resources. This issue stems from insufficient validation of user-supplied input during the import process, allowing authenticated attackers with low privileges to manipulate file paths passed by the application logic. By exploiting this weakness, an attacker can specify arbitrary files on the underlying operating system for deletion, rather than being restricted solely to intended template or asset directories. The root cause lies in the failure to sanitize directory traversal sequences such as dot-dot-slash (../) within the import parameters, which leads directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-732: Incorrect Permission Assignment for Critical Resource.
From an operational perspective, the impact of this vulnerability is severe because it enables Denial of Service conditions through the destruction of critical system files or configuration data. If an attacker successfully deletes essential PHP scripts, database connection files, or core framework components, the web application may become completely unavailable to legitimate users. Furthermore, in environments where file deletion can be chained with other vulnerabilities such as arbitrary file upload, this flaw could potentially facilitate Remote Code Execution by removing security controls like .htaccess rules or access logs that monitor malicious activity. The attack vector typically requires authentication, meaning a compromised user account is necessary to initiate the exploit, which aligns with ATT&CK technique T1074: Data Staged or more specifically T1565: Stored Data Manipulation when considering the persistence aspect of deleting security artifacts.
The exploitation mechanism generally involves intercepting HTTP requests associated with the template import functionality and modifying parameters that define file locations. Since the application does not strictly enforce a whitelist of allowed directories, an attacker can traverse up the directory tree to target files outside the web root or critical system paths. This lack of strict path canonicalization allows for precise targeting of sensitive files such as wp-config.php in WordPress environments or similar configuration files in other CMS platforms that utilize this plugin architecture. The consequence is not merely data loss but a fundamental breakdown of application availability and potential exposure of sensitive information if the deletion triggers error messages that reveal server paths during failure states.
Mitigation strategies must prioritize immediate patching to version 1.0.17 or later, where developers have implemented strict input validation and path canonicalization checks before executing file system operations. Administrators should ensure that the web server process runs with minimal privileges, adhering to the principle of least privilege, so that even if an attacker succeeds in deleting files, they cannot access sensitive data outside their designated scope. Additionally, implementing Web Application Firewall rules can help detect and block requests containing directory traversal patterns or unusual file deletion attempts targeting system directories. Regular audits of plugin code for proper use of functions like realpath() to resolve symbolic links and verify that the final resolved path remains within an expected base directory are essential preventive measures against this class of vulnerability.