CVE-2026-108790: westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal
A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
Yes. The CVSS vector specifies high privileges required (PR:H), so an attacker needs a high-privilege account before exploiting the issue. User interaction is not required.
Can an attacker exploit this over the network?
Yes. The flaw is remotely exploitable, and the CVSS vector lists network attack access (AV:N) with low attack complexity (AC:L).
What is the expected security impact if exploitation succeeds?
The CVSS vector rates confidentiality, integrity, and availability impact as low. The scope is unchanged, meaning the impact is assessed within the affected security authority.
Is exploit code publicly available?
Yes. The available information states that an exploit has been publicly released and may be used in attacks.