westboy CicadasCMS CVE-2025-11289

No vendor-released patch is identified at time of analysis. Primary mitigation requires upgrading CicadasCMS to a patched version beyond commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, with version details available from https://github.com/westboy/CicadasCMS or via the vendor. Immediate compensating controls include: (1) restrict Template Management Page access to strictly necessary high-privilege users via role-based access control, reducing the attack surface; (2) implement Content Security Policy (CSP) headers with strict-dynamic and script-src restrictions to mitigate stored XSS payload execution in browsers; (3) enable HTML/JavaScript input validation and output encoding in template file processing, ensuring all user input is escaped before storage; (4) audit all existing templates for suspicious content and monitor template modification logs for unauthorized changes. Each mitigation has trade-offs: restricting access may reduce functionality, CSP may break legitimate dynamic content, and template scanning requires manual effort.