Executive brief
Subrion CMS is a popular open-source PHP content management system used to build and manage websites. A vulnerability allows authenticated administrators to delete arbitrary files from the server by exploiting unsanitized file paths in the admin panel. An attacker with admin credentials can delete critical system files, causing service outages or creating opportunities for further attacks on the server.
Technical details
This is a path traversal vulnerability in the file deletion endpoint of Subrion CMS through version 4.2.1. The vulnerable code passes user-supplied file paths directly to PHP's unlink() function without proper sanitization or path canonicalization, allowing directory traversal sequences (e.g., ../../../) to reach files outside the intended directory. The attack requires valid administrator credentials and access to the admin panel file deletion feature. An authenticated admin can delete arbitrary files on the filesystem, including configuration files, system files, or application code outside the web root, leading to denial of service or privilege escalation opportunities. A patch or version update addressing path validation is recommended.
Affected products
- Intelliants Subrion CMS through 4.2.1
Timeline
- 2026-08-11: disclosed