Quick answers
- Is CVE-2026-108790 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108790 being exploited in the wild.
- How severe is CVE-2026-108790?
- Medium severity, with a CVSS score of 4.7, published 12 October 2026.
- Which products and versions are affected?
- Westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.
- Is there a fix for CVE-2026-108790?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-108790 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-108790?
- Check whether you run Westboy CicadasCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The TemplateController.save() endpoint accepts a TemplateFile object with user-controlled filePath and content parameters and passes them directly to TemplateFileServiceImpl.writeTemplateFileContent(), which opens a FileOutputStream without any directory whitelist, canonical-path validation, or filtering of path traversal sequences. An authenticated attacker with template:save permission can exploit this to write arbitrary files, including JSP shells into the web application directory for remote code execution on WAR-based deployments.
Affected products
- westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Timeline
- 2026-10-12: disclosed