PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108790 westboy CVE debrief

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be performed from remote. The vulnerability allows attackers to write arbitrary files, potentially leading to remote code execution or unauthorized data access. Defenders should assess potential exposure and risks associated with this vulnerability.

Vendor
westboy
Product
CicadasCMS
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for westboy CicadasCMS deployments, particularly those using the Backend Template Editor, should assess potential exposure and risks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, assess risks, and apply mitigations or patches if available.

Why it matters

Defenders should prioritize verifying exposure of CicadasCMS Backend Template Editor and assessing potential path traversal risks due to the remote attack surface and potential for unauthorized file access.

  • Path traversal attacks may allow unauthorized file access
  • Potential for data breaches or system compromise

Technical summary

The vulnerability is located in the TemplateController.save function of the /system/cms/template/save file in the Backend Template Editor component of westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. An attacker can perform a path traversal attack remotely, potentially leading to unauthorized file access or remote code execution. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. There is no information on mitigations or patches from the vendor. Defenders should prioritize verifying exposure and assessing potential risks.

Defensive priority

Defenders should prioritize verifying exposure of CicadasCMS Backend Template Editor and assessing potential path traversal risks.

Recommended defensive actions

  • Verify exposure of CicadasCMS Backend Template Editor
  • Assess potential path traversal risks
  • Review TemplateController.save function for vulnerabilities
  • Apply vendor patches if available
  • Implement compensating controls for exposed systems
  • Monitor relevant logs for suspicious activity
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, but vendor comments or additional technical analysis are lacking. The exploit has been released to the public and may be used for attacks. There is no information on mitigations, patches, or affected product versions from the vendor. Defenders should verify exposure and assess potential path traversal risks.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108790 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108790

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108790 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108790

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108790.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416569

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/416569/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-108790

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/959802

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/wawyw/cve_report/blob/main/CicadasCMS_1.md

    Supplemental source - exploit

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.