CVE-2026-8740 - Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine

Back Back to CVE browser

MEDIUM

Sanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine

Published May 17, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A flaw has been found in Sanluan PublicCMS 5.202506.d. The impacted element is the function execute of the file publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java of the component templateResult API. This manipulation of the argument templateContent causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Sanluan Product PublicCMS Default
n/a
- Version
  5.202506.d
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sanluan

PublicCMS

n/a

Version	Status	Constraints
5.202506.d	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1336

CWE-791

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30689
Advisory
https://vuldb.com/submit/809932
third-party-advisory
https://vuldb.com/vuln/364328
vdb-entrytechnical-description
https://vuldb.com/vuln/364328/cti
signaturepermissions-required
https://vulnplus-note.wetolink.com/share/ILcCnOvJ1fMc
exploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30689		Advisory
https://vuldb.com/submit/809932		third-party-advisory
https://vuldb.com/vuln/364328		vdb-entrytechnical-description
https://vuldb.com/vuln/364328/cti		signaturepermissions-required
https://vulnplus-note.wetolink.com/share/ILcCnOvJ1fMc		exploit