CVE-2026-108791: westboy CicadasCMS path traversal in template management

CVE-2026-108791 · Severity: medium · CVSS 4.3 · Published 2026-10-12

CicadasCMS is a content management system with a template editing feature accessible to authenticated administrators. An attacker with backend access and template editing permissions can read any file on the server—including system files, configuration data, and database credentials—due to insufficient validation of file paths. This enables credential theft, lateral movement, and full system compromise when combined with file write capabilities.

Technologies: Westboy CicadasCMS. Vendors: Westboy.

Quick answers

Is CVE-2026-108791 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108791 being exploited in the wild.
How severe is CVE-2026-108791?
Medium severity, with a CVSS score of 4.3, published 12 October 2026.
Which products and versions are affected?
Westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab.
Is there a fix for CVE-2026-108791?
No fixed version is recorded yet. Restrict template management access to trusted users only; implement strict file path validation using canonicalization and whitelist directories; construct file paths server-side based on approved parameters rather than client input; audit and monitor access logs for suspicious template read activity. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108791 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-108791?
Check whether you run Westboy CicadasCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict template management access to trusted users only; implement strict file path validation using canonicalization and whitelist directories; construct file paths server-side based on approved parameters rather than client input; audit and monitor access logs for suspicious template read activity.

Technical details

The TemplateController.input endpoint in the /system/cms/template/input file read interface uses an unsanitized filePath parameter directly in file operations without path canonicalization or whitelist validation, enabling arbitrary file read via path traversal. The vulnerability requires authentication with template:edit permissions (granted to admins by default) and a network connection to the application; exploitation yields sensitive files including /etc/passwd, environment variables with database credentials, and application configuration. No patched version has been confirmed.

Affected products

  • westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab

Timeline

  • 2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.