CVE-2026-108791 Details

A path traversal vulnerability has been identified in CicadasCMS versions prior to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The issue resides in the TemplateController.input function within the Template Management component. The vulnerability allows authenticated users with template editing permissions to manipulate the filePath argument, leading to arbitrary file read. Exploitation of this vulnerability can be done remotely, and the published exploit demonstrates its potential for abuse.

To address this vulnerability, implement a path whitelist for the 'findByPath'/'input' read operations, restricting access to files within the template root directory. Validate the 'canonicalPath' prefix to prevent unauthorized file access. Additionally, construct the file path on the server side based on site/template parameters, avoiding direct use of client-provided 'filePath' values. Sanitize responses to prevent arbitrary file content from being rendered on the page. Finally, restrict permissions for template management functions and audit access logs to monitor for any unauthorized activities.