CicadasCMS CVE-2026-108791

Requires an authenticated low-privileged session (CVSS PR:L) on the CicadasCMS application and access to the Template Management feature's TemplateController.input handler at /system/cms/template/input. The attacker manipulates the filePath argument to traverse outside the intended directory. Limiting factors: valid credentials are mandatory (not exploitable fully unauthenticated), impact is confined to reading files (no write, no code execution), and exposure depends on the affected version up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab being deployed and reachable.

This is a moderate, not high-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reachability with low attack complexity, but critically requires PR:L - the attacker must already hold a low-privileged authenticated session, which substantially narrows the exposed population. Impact is limited to VC:L (low confidentiality) with no integrity or availability impact, consistent with a read-oriented path traversal that discloses arbitrary file contents rather than enabling code execution. A public exploit exists (E:P / POC=YES), raising practical reproducibility, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the signal set points to opportunistic rather than mass exploitation. The vendor was contacted and did not respond, meaning no official patch is confirmed. Net assessment: a real but contained authenticated information-disclosure flaw in a niche product; prioritize only where CicadasCMS is deployed and accepts low-privilege accounts.

An attacker with a low-privileged authenticated account on a CicadasCMS instance sends a crafted request to the Template Management input endpoint (/system/cms/template/input), supplying a filePath argument containing directory-traversal sequences. Because a public proof-of-concept is available, the attacker reads arbitrary files outside the intended template directory (e.g., configuration or credential files), facilitating further compromise. Low attack complexity and network vector make the request trivial to automate once valid credentials are obtained.