CVE-2026-3289

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3289

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3289.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3289

Published

2026-02-27T04:32:10.857Z

Modified

2026-07-15T01:49:10.824086125Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal

Details

A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3289.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.202506.d"
                },
                {
                    "last_affected": "6.202506.d"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/sanluan/publiccms

Affected ranges

Type

GIT

Repo

https://github.com/sanluan/publiccms

Events

Introduced

0ad2201fc2dcd564bbc272f7db2af304abd6c486

Last affected

0ad2201fc2dcd564bbc272f7db2af304abd6c486

Database specific

{
    "cpe": "cpe:2.3:a:publiccms:publiccms:6.202506.d:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "6.202506.d"
        },
        {
            "last_affected": "6.202506.d"
        }
    ]
}

Affected versions

6.*

6.202506.d

V6.*

V6.202506.e

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3289.json"