CVE-2026-108790
Received Received - Intake

Path Traversal in CicadasCMS Backend Template Editor

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108790
EUVD
EUVD-2026-97160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
westboy CicadasCMS 2431154dac8d0735e04f1fd2a3c3556668fc8dab

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108790 is a path traversal vulnerability in CicadasCMS affecting the TemplateController.save function in the Backend Template Editor. It allows authenticated users with specific permissions to manipulate file paths and write arbitrary files to the server, bypassing intended restrictions.

Detection Guidance

Check for unauthorized file modifications in the CicadasCMS template directory or suspicious file writes outside expected paths. Review server logs for POST requests to /system/cms/template/save with unusual file paths or parameters.

Impact Analysis

This vulnerability can allow attackers to overwrite critical files like configuration files, templates, or plant malicious scripts (e.g., web shells) on the server. This may lead to remote code execution, data theft, or system compromise if exploited.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing sensitive data stored in configuration files or templates. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and user rights. For HIPAA, it could compromise protected health information if configuration files or templates containing such data are overwritten or accessed without authorization.

Mitigation Strategies

Restrict file write permissions to the template directory only. Implement path validation to prevent directory traversal. Add CSRF protection to backend actions. Isolate template directories from executable paths in WAR deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108790. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart