CVE-2026-108791
Received Received - Intake

Path Traversal in CicadasCMS Template Management

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108791
EUVD
EUVD-2026-97162

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
westboy CicadasCMS 2431154dac8d0735e04f1fd2a3c3556668fc8dab

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in CicadasCMS affecting the TemplateController.input function. It allows authenticated users to read arbitrary files on the server by manipulating the filePath parameter in requests to /system/cms/template/input. The issue occurs because the application does not validate the filePath input before using it in a file operation.

Detection Guidance
  • Check if your CicadasCMS instance has the vulnerable endpoint by sending a test request to /system/cms/template/input?filePath=/etc/passwd. If the response contains system user data, the vulnerability is present.
  • Inspect access logs for unusual requests to /system/cms/template/input with filePath parameters pointing to sensitive files like /etc/passwd, /proc/self/environ, or configuration files.
  • Use curl commands to test for arbitrary file reads: curl -u admin:password 'http://target/system/cms/template/input?filePath=/etc/passwd' and check if file contents are returned.
Impact Analysis

An attacker with template:edit permissions can read sensitive files like /etc/passwd, environment variables containing database credentials, application JARs, Docker metadata, and system configuration files. This could lead to further attacks like privilege escalation or lateral movement within the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosures, and non-compliance with data protection regulations.

Mitigation Strategies
  • Immediately restrict access to the /system/cms/template/input endpoint by implementing strict authentication and authorization checks.
  • Apply input validation to the filePath parameter to ensure it only accesses files within the intended template directory.
  • Update CicadasCMS to a patched version if available, or apply a temporary fix by disabling the vulnerable function until a patch is released.
  • Monitor and audit all access to template management functions to detect any exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart