CicadasCMS CVE-2026-108790

Exploitation requires an authenticated session with privileged backend access to the CicadasCMS Backend Template Editor and the ability to invoke the TemplateController.save action at /system/cms/template/save (PR:H in the CVSS vector confirms high-privilege/admin access is needed). The specific prerequisite is reaching that admin-only save function with attacker-controlled path input containing traversal sequences. Limiting factors: the attacker must first authenticate as a privileged operator (no PR:N), which is the primary mitigation; no user interaction is required (UI:N) and no non-default configuration is needed beyond having the backend enabled. There is no fixed version available since the vendor did not respond, so compensating controls (restricting backend access, strong admin credentials, network segmentation of the admin panel) are the practical defenses.

This is a high-CVSS-but-moderate-real-risk issue, and even the CVSS is only medium (5.1, CVSS 4.0). The vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity attack but one that requires PR:H - high privileges, i.e. an authenticated backend administrator with access to the Template Editor. A path-traversal write/read in an admin-only template-save function is therefore gated behind privileged access, sharply limiting its blast radius to attackers who already hold or have stolen admin credentials. The impact metrics are all 'Low' (VC:L/VI:L/VA:L), and scope/subsequent-system metrics are None, indicating limited damage per the vendor-neutral VulDB scoring. On the exploitation side, a public exploit (E:P, GitHub PoC) exists, which raises practical likelihood for anyone with backend access, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent: medium severity + authenticated-only + PoC-but-no-KEV points to an opportunistic/post-authentication concern rather than an internet-wide emergency. Note: no EPSS probability was supplied, so exploitation likelihood cannot be quantified from the data.

An attacker who already holds (or has phished/credential-stuffed) a privileged CicadasCMS backend account logs into the Template Editor and submits a crafted request to /system/cms/template/save in which a template path/filename field contains traversal sequences (e.g. ../../), causing the TemplateController.save function to read or write files outside the intended template directory. A public proof-of-concept for this exact endpoint is published on GitHub, lowering the skill barrier to reproduce the attack.