The vulnerability lies in the TemplateController.save function of the Backend Template Editor in CicadasCMS. It permits an attacker to manipulate the file path used when saving templates, resulting in a path traversal flaw. By exploiting this weakness, an attacker can write files to arbitrary locations on the server, potentially placing malicious code or corrupting critical files. This lack of proper input validation is the root cause (CWE‑22).

Westboy CicadasCMS is affected. The flaw exists in all releases up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab. No specific minor versions are listed, so any deployment of the vulnerable code should be considered at risk until an updated version is applied.

The CVSS score of 5.1 indicates a moderate risk. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is remote; the public exploit is available, implying that an unauthenticated remote user could craft a request to the /system/cms/template/save endpoint and cause a traversal. Because the flaw allows arbitrary file write, malicious code execution and data modification are possible, which could compromise confidentiality, integrity, and availability of the application.