CyberRota Analysis
AI-GeneratedIntelliants Subrion CMS versions up to 4.2.1 are vulnerable to a path traversal issue that allows authenticated administrators to delete arbitrary files on the server through an insecure file deletion endpoint. This lack of input validation can lead to the deletion of sensitive system files, potentially destabilizing the server and opening avenues for further exploitation. Organizations using this CMS should prioritize patching to mitigate the risk of unauthorized file deletion and subsequent attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.