The vulnerability allows remote attackers to supply a crafted filePath argument to the TemplateController.input function within the Template Management component of CicadasCMS. The flaw permits path traversal, enabling the attacker to access files outside the intended directory. The result is potential exposure of sensitive data, system configuration files, or other confidential assets. The weakness corresponds to CWE-22 and carries a CVSS score of 5.3, indicating a medium severity impact on confidentiality.

Westboy CicadasCMS versions up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab are affected. The path traversal flaw resides in the TemplateController.input method located in /system/cms/template/input. No specific vendor version ranges are listed beyond the commit identifier, so all installations of CicadasCMS that include this code path are vulnerable until a fix is released.

With no published patch available, the risk remains medium due to the CVSS of 5.3. The EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely, but the existence of a publicly available exploit suggests that malicious actors could leverage this vulnerability. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to deliver a crafted request to the TemplateController.input endpoint, which is typically exposed over HTTP, making remote exploitation feasible if the CMS is accessible over the internet.