CVE-2026-108791
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A weakness in CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab affects the TemplateController.input function in the file /system/cms/template/input of the Template Management component. Manipulation of the filePath argument causes path traversal. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
A remote attacker can exploit path traversal to read or write files outside the allowed directory, potentially leading to data leakage or system compromise.
Recommendation
Update CicadasCMS to the latest version or apply security patches to prevent file path manipulation.
Other vulnerabilities in CicadasCMS
See all- CVE-2026-108790Medium
A path traversal vulnerability has been discovered in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, affecting the TemplateController.save function in /system/cms/template/save (Backend Template Editor component). The attack can be performed remotely and a public exploit is already available. The vendor was contacted but did not respond.
- CVE-2026-10529Low
Vulnerability in westboy CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An unknown function in ScheduleJobController.java in the task scheduling module is vulnerable to XSS. The attack can be performed remotely.
- CVE-2026-10153Medium
In westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, the Search function in org/springframework/cache/support/AbstractCacheManager.java is vulnerable to cross-site scripting (XSS) via the s argument. Remote exploitation is possible and the exploit is public.
- CVE-2025-11289Low
A vulnerability was found in CicadasCMS (up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab) in the Save function of TemplateFileServiceImpl.java, within the template management component. The cross-site scripting (XSS) flaw allows remote exploitation. The exploit has been publicly disclosed and may be used.
- CVE-2025-11069Low
A vulnerability was determined in westboy CicadasCMS 1.0. The issue affects the Add Department Handler in /system/org/save. Manipulation of the argument Name causes cross site scripting. The attack can be carried out remotely and the exploit is public.
- CVE-2025-11068Low
A vulnerability in westboy CicadasCMS 1.0 affects an unknown functionality in the /system/cms/category/save file. Manipulation of the categoryName argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS