CVE-2026-108790: Path Traversal in westboy CicadasCMS

A path traversal vulnerability exists in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, specifically in the TemplateController.save function within /system/cms/template/save of the Backend Template Editor component. This vulnerability allows an attacker with high privileges to remotely manipulate file paths, potentially leading to unauthorized file access. Public exploit code has been released. The vendor was contacted but did not provide any response or patch information.

An attacker with high privileges can exploit this path traversal vulnerability remotely to access or modify files outside the intended directory scope, potentially leading to unauthorized information disclosure or modification. The vulnerability has a medium CVSS score (5.1) indicating moderate impact. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, restrict access to the affected component to trusted users only and consider additional access controls to limit exploitation.