CVE-2026-108790: CicadasCMS Path Traversal Vulnerability

CVE-2026-108790 Overview

CVE-2026-108790 is a path traversal vulnerability [CWE-22] affecting westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The flaw resides in the TemplateController.save function of the /system/cms/template/save endpoint, part of the Backend Template Editor component. An authenticated remote attacker can manipulate file path parameters to write or modify files outside the intended template directory. Public exploit details have been released, increasing the risk of opportunistic attacks. The vendor was notified early but did not respond to the disclosure.

Critical Impact
Authenticated remote attackers can traverse the file system through the template save handler and write content to arbitrary locations within the application context.

Affected Products

westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Component: Backend Template Editor
Endpoint: /system/cms/template/save

Discovery Timeline

2026-10-12 - CVE-2026-108790 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108790

Vulnerability Analysis

The vulnerability resides in the TemplateController.save method handling requests to /system/cms/template/save. The handler accepts a user-controlled file path or template name parameter and passes it to file-write operations without normalizing or validating directory separators. Attackers submit sequences such as ../ to escape the intended template root and write files to arbitrary directories accessible to the web application process. Because the Backend Template Editor permits raw template content, an attacker can place executable server-side files or overwrite legitimate assets. The attack requires authentication with high privileges but no user interaction. See the GitHub CVE Report and VulDB entry for the published proof of concept. The current EPSS probability is 0.541%.

Root Cause

The root cause is missing path canonicalization and input validation in the template save routine. The controller trusts caller-supplied filename or path fields and performs file I/O relative to the template directory without rejecting traversal sequences or enforcing an allowlist of safe filenames.

Attack Vector

Exploitation occurs over the network against the CicadasCMS backend. An attacker with authenticated backend access submits a crafted POST request to /system/cms/template/save containing a path parameter with ../ traversal segments. The server resolves the manipulated path and writes attacker-controlled content outside the template root.

No verified exploit code is reproduced here. Refer to the published GitHub CVE Report for technical reproduction steps.

Detection Methods for CVE-2026-108790

Indicators of Compromise

POST requests to /system/cms/template/save containing ../, ..\\, or URL-encoded equivalents (%2e%2e%2f) in path or filename parameters.
Newly created or modified files outside the CicadasCMS template directory, especially server-executable files (.jsp, .war, .class).
Unexpected template save activity from administrator accounts outside normal change windows.

Detection Strategies

Deploy web application firewall rules that normalize request parameters and block traversal patterns targeting the /system/cms/template/* paths.
Enable file integrity monitoring on the application deployment directory to flag out-of-band writes.
Correlate authenticated backend sessions with file-system write events generated by the Java servlet container process.

Monitoring Recommendations

Alert on backend administrator logins from unusual source IPs or geolocations preceding template editor activity.
Track process-child relationships from the servlet container that spawn shells or interpreters, which may indicate successful webshell execution.
Review access logs for repeated template/save requests with varied path parameters, consistent with traversal probing.

How to Mitigate CVE-2026-108790

Immediate Actions Required

Restrict network access to the CicadasCMS backend interface using IP allowlisting or VPN enforcement.
Rotate credentials for all accounts with backend template editor privileges and audit recent template changes.
Scan the template and web root directories for unauthorized files written since the vulnerable commit was deployed.

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to the disclosure according to the VulDB entry. Organizations should treat the deployment as unmaintained and plan migration to a supported CMS.

Workarounds

Disable or remove the Backend Template Editor component if template editing is not operationally required.
Apply a reverse-proxy filter that rejects requests to /system/cms/template/save containing traversal sequences or non-allowlisted filenames.
Run the application under a least-privilege service account with write access limited to the intended template directory only.

bash

# Example nginx reverse-proxy rule blocking traversal attempts to the template save endpoint
location /system/cms/template/save {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|/%2e%2e)") {
        return 403;
    }
    proxy_pass http://cicadascms_backend;
}