CVE-2026-108791: CicadasCMS Path Traversal Vulnerability

CVE-2026-108791 Overview

CVE-2026-108791 is a path traversal vulnerability [CWE-22] in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The flaw resides in the TemplateController.input function handling requests to /system/cms/template/input within the Template Management component. An authenticated remote attacker can manipulate the filePath argument to traverse directories and access files outside the intended template directory. A public exploit has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the CicadasCMS application process by supplying crafted filePath values, exposing source code, configuration data, and credentials.

Affected Products

westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab
Template Management component (/system/cms/template/input)
TemplateController.input function

Discovery Timeline

2026-10-12 - CVE-2026-108791 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108791

Vulnerability Analysis

The vulnerability exists in the TemplateController.input handler of CicadasCMS. The endpoint accepts a filePath parameter that is passed to file system operations without sufficient normalization or validation. Attackers can supply traversal sequences such as ../ to escape the intended template directory. Successful exploitation discloses the contents of files readable by the web application's runtime user. Public exploit code is available, lowering the barrier to attack.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The filePath argument is concatenated or resolved into a file system path without canonicalization or allow-list enforcement. Standard mitigations such as rejecting .. sequences, resolving the canonical path, and verifying it remains within the template root are not applied before the file read occurs.

Attack Vector

Exploitation requires network access to the CicadasCMS web interface and low-privileged authenticated credentials. The attacker sends an HTTP request to /system/cms/template/input with a crafted filePath value containing traversal sequences. The server returns the contents of the referenced file. No user interaction is required. See the GitHub CVE Report and VulDB CVE-2026-108791 for the published proof-of-concept details.

Detection Methods for CVE-2026-108791

Indicators of Compromise

HTTP requests to /system/cms/template/input containing ../, ..%2f, or URL-encoded traversal sequences in the filePath parameter.
Access attempts targeting sensitive files such as /etc/passwd, WEB-INF/web.xml, or application configuration files via the filePath argument.
Unexpected file read activity by the CicadasCMS application process outside the template directory.

Detection Strategies

Deploy web application firewall rules that inspect query and body parameters for path traversal patterns on the Template Management endpoint.
Correlate authenticated session activity against anomalous filePath values to identify credential abuse.
Review application logs for repeated 200-status responses to /system/cms/template/input requests from a single session.

Monitoring Recommendations

Enable verbose logging on the TemplateController, capturing full request parameters and the resolved file system path.
Forward web server and application logs to a central analytics platform for traversal pattern detection.
Alert on file reads outside the configured template root performed by the application service account.

How to Mitigate CVE-2026-108791

Immediate Actions Required

Restrict network access to the CicadasCMS administrative interface to trusted IP ranges until a fix is available.
Rotate credentials for all low-privileged accounts that could be used to reach /system/cms/template/input.
Audit server file systems for evidence of unauthorized file reads via the Template Management endpoint.

Patch Information

No vendor patch is available. The maintainer of westboy CicadasCMS did not respond to disclosure attempts. Organizations running this software should treat it as unmaintained for security purposes and plan migration or compensating controls. Monitor the VulDB Vulnerability #416570 entry for updates.

Workarounds

Block requests to /system/cms/template/input at a reverse proxy or WAF when the filePath parameter contains .., %2e%2e, or absolute path prefixes.
Run the CicadasCMS process under a dedicated low-privilege account with file system access limited to the template directory.
Apply mandatory access controls (SELinux, AppArmor) to confine the application's readable paths.
Consider removing or disabling the Template Management endpoint if it is not required in production.

bash

# Example nginx rule to block traversal attempts against the vulnerable endpoint
location /system/cms/template/input {
    if ($arg_filePath ~* "(\.\./|\.\.\\|%2e%2e|^/)") {
        return 403;
    }
    proxy_pass http://cicadascms_backend;
}