CVE-2026-1111
📋 TL;DR
This CVE describes a path traversal vulnerability in Sanluan PublicCMS that allows attackers to write files to arbitrary locations on the server. The vulnerability affects PublicCMS installations up to version 5.202506.d and can be exploited remotely via the Task Template Management Handler component.
💻 Affected Systems
- Sanluan PublicCMS
📦 What is this software?
Publiccms by Publiccms
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file writes allowing web shell deployment, configuration modification, or data manipulation.
If Mitigated
Limited impact if proper file system permissions and input validation are in place.
🎯 Exploit Status
Exploit disclosed on GitHub, requires admin access to Task Template Management Handler.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version beyond 5.202506.d if released by vendor.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation on the 'path' parameter to prevent directory traversal sequences.
Implement validation in com/publiccms/controller/admin/sys/TaskTemplateAdminController.java to reject paths containing '../' or absolute paths
File System Permissions
linuxRestrict write permissions to only necessary directories for the web application user.
chmod -R 755 /var/www/publiccms/
chown -R www-data:www-data /var/www/publiccms/
🧯 If You Can't Patch
- Disable or restrict access to the Task Template Management Handler component
- Implement web application firewall (WAF) rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check PublicCMS version in admin panel or configuration files. If version is 5.202506.d or earlier, system is vulnerable.Check Version:
Check WEB-INF/classes/version.properties or admin dashboard for version informationVerify Fix Applied:
Test the Save function with path traversal payloads (e.g., '../../malicious.php') to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in web server logs
- Requests to TaskTemplateAdminController with path parameters containing '../'
Network Indicators:
- HTTP POST requests to /admin/sys/taskTemplate/save with suspicious path parameters
SIEM Query:
source="web_logs" AND uri="/admin/sys/taskTemplate/save" AND (path="*../*" OR path="*..\\*" OR path="*/../*")