CVE-2026-109160
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
An attacker can redirect users to malicious sites, facilitating phishing and credential theft; the publicly known exploit increases the risk of rapid exploitation.
Recommendation
Restrict or validate the returnUrl parameter server-side and consider applying your own fix, as the vendor has not responded to the report.
Other vulnerabilities in PublicCMS
See all- CVE-2025-65836Critical
PublicCMS V5.202506.b is vulnerable to SSRF in the chat interface of SimpleAiAdminController.
- CVE-2023-34852Critical
PublicCMS versions up to 4.0.202302 are vulnerable to insecure permissions, potentially allowing unauthorized access to resources.
- CVE-2026-110113Medium
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.
- CVE-2026-97721Low
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. The vulnerability affects the CmsContentAdminController function in SysUserAdminController.java within the exportExcel/exportData component. Manipulation of the userId/deptId arguments causes authorization bypass, and the attack can be initiated remotely. The exploit has been made publicly available and could be used for attacks.
Original NVD description (English source)
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS