CVE-2026-108791: westboy CicadasCMS Template Management input TemplateController.input path traversal
A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely, but the severity vector indicates that low-level privileges are required. No user interaction is required.
Which deployments are affected?
westboy CicadasCMS versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab are affected. The vulnerable functionality is Template Management, specifically TemplateController.input at /system/cms/template/input.
How serious is exploitation and is public exploit code available?
Successful exploitation may expose a limited amount of confidential information; integrity and availability impacts are not indicated. A public exploit is available, increasing the likelihood of attempted attacks.
Is a vendor fix or response available?
The vendor was contacted early about the disclosure but did not respond. The provided information does not identify a fixed version or an available vendor patch.