CVE-2026-8739

MEDIUM

Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key . The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-364327 | Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
https://vuldb.com/vuln/364327
Signature, Permissions Required signature permissions-required
VDB-364327 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/364327/cti
Third Party Advisory third-party-advisory
Submit #809917 | PublicCMS V5.202506.d Anonymous Private File Download
https://vuldb.com/submit/809917

Scores

CVSS v3 5.3
EPSS 0.0028
EPSS Percentile 19.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-320 CWE-321
Status published
Products (1)
Sanluan/PublicCMS 5.202506.d
Published May 17, 2026
Tracked Since May 17, 2026