InstantCMS has Multiple CSRF Vulnerabilities
Priority LOW 30CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed icms2 (instantsoft): 2.18.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| instantsoft | icms2 | before 2.18.1 | 2.18.1 | Patch available | CNA |
- icms2 Vendorinstantsoft Affected before 2.18.1 Fixed in 2.18.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:* | before 2.18.1 | Vulnerable | InstantCMS |
- cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:* Versions before 2.18.1 Vulnerable ·InstantCMS
Remediation
- Fix · CNA icms2 (instantsoft) Fixed in 2.18.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-28281
References
More instantsoft vulnerabilities
- TI-2023-03877 SQL Injection in instantsoft/icms2 CVSS 3.1CRITICAL 9.1
- TI-2024-20589 SQL injection in index_chart_data action CVSS 3.1HIGH 7.2
- TI-2023-04538 SQL Injection in instantsoft/icms2 CVSS 3.1HIGH 7.2
- TI-2025-36697 InstantCMS vulnerable to Server-Side Request Forgery via package installer CVSS 3.1HIGH 7.2
- TI-2023-04291 Cross-site Scripting (XSS) - Reflected in instantsoft/icms2 CVSS 3.1MEDIUM 6.1
- TI-2026-39443 InstantCMS has Remote Code Execution in package installer CVSS 3.1MEDIUM 5.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences