Vulnerability · Published Feb 27, 2026 · Assigned by VulDB

CVE-2026-3289Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal

Medium 6.3

In plain English

A medium-severity path traversal in PublicCMS from Sanluan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.8%top 44.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Sanluan	PublicCMS	6.202506.d

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-348017 | Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal vdb-entry, technical-description
VDB-348017 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #759109 | publiccms V6.202506.d RCE third-party-advisory
https://www.yuque.com/la12138/pa2fpb/wdggytgi4vhl93zd?singleDoc exploit