A path traversal flaw in the admin panel file deletion endpoint permits an authenticated administrator to delete any file on the server because the supplied path is passed directly to unlink() without sanitization. This flaw enables removal of critical system files outside the web root, which can destabilize the server, disrupt services, or open the door to further exploitation.

Intelliants Subrion CMS, up to and including version 4.2.1, is affected. Administrators with access to the CMS admin interface can exploit this flaw.

The CVSS score of 6.5 reflects moderate severity, as the flaw requires administrative authentication and does not provide direct code execution. Although EPSS is not available, the vulnerability is not listed in the CISA KEV catalog. An attacker who is a legitimate administrator can delete arbitrary files or potentially drop malicious payloads via the same endpoint, increasing the risk of escalation.