CVE-2026-3289

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3289

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3289.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3289

Published

2026-02-27T05:18:21.613Z

Modified

2026-04-10T05:42:32.655138Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Git / github.com/sanluan/publiccms

Affected ranges

Type

GIT

Repo

https://github.com/sanluan/publiccms

Events

Introduced

Last affected

e8011b40a950c977dc5f20de7d2870431bc372d6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.202506.d"
        }
    ]
}

Affected versions

Other

V2016

V4.*

V4.0.180707

V4.0.181024

V4.0.190312

V4.0.202004

V4.0.202107

V5.*

V5.202302.a

V5.202302.b

V5.202302.c

V5.202302.d

V5.202302.e

V5.202302.f

V5.202406.a

V5.202406.b

V5.202406.c

V5.202406.d

V5.202406.e

V6.*

V6.202506.d

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3289.json"