CVE-2026-108791

MediumCVSS 4.3/10Last modified Oct 13, 2026

Description

A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1087946.3A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functio CVE-2026-1087954.3A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /CVE-2026-1087964.3A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the comp CVE-2026-1087974.3A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/a CVE-2026-1087987.3A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results CVE-2026-1087997.3A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::send CVE-2026-10884.3The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is du CVE-2026-108809.8OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before bei CVE-2026-1088004.3A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-s CVE-2026-1088016.3A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the CVE-2026-1088023.5A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of t CVE-2026-1088036.3A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config