CVE-2026-72604 Overview
CVE-2026-72604 is a path traversal vulnerability [CWE-22] affecting Intelliants Subrion CMS through version 4.2.1. The flaw resides in the admin panel file deletion endpoint, which passes a user-supplied file path directly to PHP's unlink() function without sanitization or canonicalization. Authenticated administrators can supply traversal sequences to delete arbitrary files outside the web root. Successful exploitation can destabilize the server or enable follow-on attacks by removing critical configuration or system files.
Critical Impact
An authenticated administrator can delete arbitrary files on the underlying server, causing loss of integrity and availability of application and system files.
Affected Products
- Intelliants Subrion CMS versions through 4.2.1
- Deployments exposing the admin panel file management endpoint
- Any installation permitting administrator access without additional hardening
Discovery Timeline
- 2026-08-11 - CVE-2026-72604 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72604
Vulnerability Analysis
The vulnerability exists in the Subrion CMS admin panel file deletion endpoint. The endpoint accepts a file path parameter from an authenticated administrator and forwards it to PHP's unlink() function. No validation, sanitization, or path canonicalization is performed before the file operation executes.
Because the path is unfiltered, an attacker can supply relative traversal sequences such as ../../ to escape the intended directory. The application then deletes the resolved file with the privileges of the PHP process, typically the web server user. Removing files such as .htaccess, config.inc.php, or PHP session data can disrupt application logic, break authentication, or open the system to secondary attacks.
Exploitation requires an authenticated administrator account, which limits the attacker population but does not prevent misuse by compromised or insider accounts. The impact spans both integrity and availability, since arbitrary files can be destroyed permanently.
Root Cause
The root cause is missing input validation on a filesystem operation. The deletion handler treats the client-supplied path as trusted and does not enforce a whitelist directory, canonicalize the path with realpath(), or reject traversal metacharacters. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.
Attack Vector
An authenticated administrator issues a request to the admin file deletion endpoint with a crafted file path parameter containing directory traversal sequences. The application resolves the path relative to its working directory and passes it to unlink(), deleting the target file. No user interaction beyond the attacker's own request is required, and the request is delivered over the network.
Refer to the Subrion Project Repository on GitHub for source-level context on affected components.
Detection Methods for CVE-2026-72604
Indicators of Compromise
- Admin panel HTTP requests containing ../ or URL-encoded %2e%2e%2f sequences in file path parameters
- Unexpected deletion of configuration files, .htaccess, or CMS core files logged by the filesystem or backup system
- Web server error entries referencing missing files that previously existed under the Subrion installation directory
Detection Strategies
- Inspect web server access logs for POST or GET requests to admin file management endpoints containing traversal patterns
- Correlate authenticated admin session activity with file deletion events on the host filesystem
- Deploy file integrity monitoring on the Subrion web root and adjacent system directories to flag unauthorized removals
Monitoring Recommendations
- Enable verbose audit logging on the Subrion admin panel and forward logs to a centralized SIEM for review
- Alert on any administrator account performing file deletions outside of expected maintenance windows
- Track filesystem unlink syscalls originating from the PHP process, especially for paths outside the CMS document root
How to Mitigate CVE-2026-72604
Immediate Actions Required
- Restrict administrator access to the Subrion admin panel using IP allowlists or VPN-only exposure
- Audit all administrator accounts and remove unused or unnecessary privileged users
- Enable filesystem-level monitoring to detect unauthorized deletions of CMS or system files
Patch Information
No vendor patch is referenced in the NVD entry at time of publication. Monitor the Intelliants Subrion GitHub repository for updates addressing the file deletion endpoint.
Workarounds
- Run the web server process under a low-privilege account with write access limited to necessary directories
- Apply a web application firewall rule that blocks traversal sequences such as ../ and %2e%2e%2f in admin panel parameters
- Take Subrion offline or place the admin panel behind additional authentication until a fix is available
# Example ModSecurity rule to block traversal patterns in admin requests
SecRule REQUEST_URI "@contains /panel/" \
"chain,id:1072604,phase:2,deny,status:403,msg:'Subrion admin traversal attempt'"
SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
