CVE-2025-3816

Deeper analysis

A critical vulnerability exists in westboy CicadasCMS version 2.0 within the Scheduled Task Handler component. The flaw resides in unknown code of the file /system/schedule/save and stems from improper handling of input that permits operating system command injection, as indicated by the associated CWE-77 and CWE-78 classifications. The issue is remotely triggerable and carries a CVSS 4.0 score of 5.1.

An attacker with high privileges can exploit the weakness over the network to inject and execute arbitrary operating system commands on the affected server. Public disclosure of the exploit code increases the likelihood that the technique could be incorporated into automated attacks or reused by other threat actors against unpatched installations.

The EPSS score for this CVE rose from a low baseline to a peak of 0.0388 on 2026-02-13 before receding to its current value of 0.0088, indicating a period of increased exploitation interest after the initial disclosure. No official patches or mitigation guidance appear among the referenced sources.