CicadasCMS Path Traversal Vulnerabilities

Authenticated path traversal in the Template Management component of westboy CicadasCMS (versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab) allows a low-privileged user to manipulate the filePath argument sent to /system/cms/template/input so that the underlying TemplateController.input handler resolves paths outside the intended template directory, exposing files that should not be readable. Exploitation requires a valid low-privileged session (CVSS PR:L) and is limited to confidentiality impact - there is no write or code-execution primitive - so this is a moderate, not high-priority issue despite being remotely reachable. Publicly available exploit code exists (a proof-of-concept is published on GitHub and linked from the VulDB advisory), and the vendor was contacted early but did not respond, so no vendor-released patch has been identified at time of analysis.

Path traversal in CicadasCMS up to commit 2431154 allows authenticated users with high-privilege backend access to manipulate the TemplateController.save function via the /system/cms/template/save endpoint, potentially leading to limited file read or write. The vulnerability requires an authenticated session with privileged backend access (PR:H) and has a medium CVSS 4.0 score of 5.1; publicly available exploit code exists. The vendor did not respond to the disclosure, and no patched version has been released.