# CVE-2026-108790: westboy CicadasCMS path traversal in template save

Source: https://junglewise.ai/threats/cve-2026-108790-a-security-flaw-has-been-discovered-in-westboy-cicadascms-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108790 · Severity: medium · CVSS 4.7 · Published 2026-10-12

CicadasCMS is a content management system backend with a template editor. A flaw in the template save function allows an authenticated user with the template:save permission to write files anywhere on the system, potentially including JSP web shells that execute arbitrary code. This could lead to complete compromise of the web application if the deployment is on a Servlet container with a writable web root.

Technologies: [Westboy CicadasCMS](https://junglewise.ai/threats/technologies/cicadascms). Vendors: [Westboy](https://junglewise.ai/threats/vendors/westboy).

## Quick answers

**Is CVE-2026-108790 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108790 being exploited in the wild.

**How severe is CVE-2026-108790?** Medium severity, with a CVSS score of 4.7, published 12 October 2026.

**Which products and versions are affected?** Westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.

**Is there a fix for CVE-2026-108790?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108790 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108790?** Check whether you run Westboy CicadasCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The TemplateController.save() endpoint accepts a TemplateFile object with user-controlled filePath and content parameters and passes them directly to TemplateFileServiceImpl.writeTemplateFileContent(), which opens a FileOutputStream without any directory whitelist, canonical-path validation, or filtering of path traversal sequences. An authenticated attacker with template:save permission can exploit this to write arbitrary files, including JSP shells into the web application directory for remote code execution on WAR-based deployments.

## Affected products

- westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/wawyw/cve_report/blob/main/CicadasCMS_1.md](https://github.com/wawyw/cve_report/blob/main/CicadasCMS_1.md)
- [https://vuldb.com/cve/CVE-2026-108790](https://vuldb.com/cve/CVE-2026-108790)

## Related threats

- [westboy CicadasCMS path traversal in template management](https://junglewise.ai/threats/cve-2026-108791-a-weakness-has-been-identified-in-westboy-cicadascms-up-to)
- [westboy CicadasCMS cross site scripting in ScheduleJobController](https://junglewise.ai/threats/cve-2026-10529-westboy-cicadascms-cross-site-scripting-in-schedulejobcontroller)
- [westboy CicadasCMS reflected XSS in search function](https://junglewise.ai/threats/cve-2026-10153-westboy-cicadascms-reflected-xss-in-search-function)