CVE-2026-1111

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1111", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-17T08:58:04.516Z", "datePublished": "2026-01-18T05:32:05.496Z", "dateUpdated": "2026-02-23T08:36:16.524Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:36:16.524Z"}, "title": "Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "Sanluan", "product": "PublicCMS", "versions": [{"version": "5.202506.a", "status": "affected"}, {"version": "5.202506.b", "status": "affected"}, {"version": "5.202506.c", "status": "affected"}, {"version": "5.202506.d", "status": "affected"}], "cpes": ["cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"], "modules": ["Task Template Management Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-17T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-05T20:56:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ana10gy (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.341703", "name": "VDB-341703 | Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341703", "name": "VDB-341703 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.732726", "name": "Submit #732726 | publiccms PublicCMS <= V5.202506.d Remote Code Execution (RCE)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/2", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"references": [{"url": "https://github.com/AnalogyC0de/public_exp/issues/2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T18:49:44.478064Z", "id": "CVE-2026-1111", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T18:53:27.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1111", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T18:49:44.478064Z"}}}], "references": [{"url": "https://github.com/AnalogyC0de/public_exp/issues/2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T18:49:55.355Z"}}], "cna": {"title": "Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Ana10gy (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"], "vendor": "Sanluan", "modules": ["Task Template Management Handler"], "product": "PublicCMS", "versions": [{"status": "affected", "version": "5.202506.a"}, {"status": "affected", "version": "5.202506.b"}, {"status": "affected", "version": "5.202506.c"}, {"status": "affected", "version": "5.202506.d"}]}], "timeline": [{"lang": "en", "time": "2026-01-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-17T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-05T20:56:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.341703", "name": "VDB-341703 | Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341703", "name": "VDB-341703 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.732726", "name": "Submit #732726 | publiccms PublicCMS <= V5.202506.d Remote Code Execution (RCE)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/2", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:36:16.524Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1111", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:36:16.524Z", "dateReserved": "2026-01-17T08:58:04.516Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-18T05:32:05.496Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"], "modules": ["Task Template Management Handler"], "product": "PublicCMS", "vendor": "Sanluan", "versions": [{"status": "affected", "version": "5.202506.a"}, {"status": "affected", "version": "5.202506.b"}, {"status": "affected", "version": "5.202506.c"}, {"status": "affected", "version": "5.202506.d"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*", "matchCriteriaId": "B937509A-33F9-4B58-9E04-4297591A198E", "versionEndIncluding": "5.202506.d", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Sanluan PublicCMS hasta la versi\u00f3n 5.202506.d. Esto afecta a la funci\u00f3n Save del archivo com/publiccms/controller/admin/sys/TaskTemplateAdminController.java del componente Task Template Management Handler. Dicha manipulaci\u00f3n del argumento path conduce a salto de ruta. El ataque puede ser lanzado remotamente. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1111", "lastModified": "2026-06-17T10:15:00.943", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1111", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T18:49:44.478064Z", "version": "2.0.3"}}]}, "published": "2026-01-18T06:16:01.007", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Mitigation", "Vendor Advisory"], "url": "https://github.com/AnalogyC0de/public_exp/issues/2"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.341703"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.341703"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.732726"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Mitigation", "Vendor Advisory"], "url": "https://github.com/AnalogyC0de/public_exp/issues/2"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:30:17.403705+00:00", "value": {"mitigation_remediation": ["Update or upgrade Sanluan PublicCMS to a version that properly validates the path parameter and includes the fix for the path traversal in TaskTemplateAdminController", "Implement application layer controls such as a web application firewall or input filtering to detect and block malicious path traversal patterns before they reach the controller", "Restrict file write permissions on the directories used by the CMS and enforce least privilege for the application process, ensuring that even if a traversal occurs, critical system files remain protected", "Restrict administrative access to the TaskTemplateAdminController endpoint through authentication and authorization controls, limiting exposure to trusted users only"], "summary": {"action": "Patch Now", "impact": "Remote Path Traversal Allowing Arbitrary File Write"}, "threat_synthesis": {"affected_systems": "Sanluan PublicCMS versions up to 5.202506.d are affected. No additional version data is provided, so all installations of the product released through this date remain vulnerable unless updated. The specific component impacted is the Task Template Management Handler implemented in com/publiccms/controller/admin/sys/TaskTemplateAdminController.java.", "description_and_impact": "A path traversal vulnerability exists in the Save function of TaskTemplateAdminController within Sanluan PublicCMS. By manipulating the input path argument, an attacker can cause the application to write files outside the intended directory. This can enable the creation or overwriting of arbitrary files on the webroot or other writable locations, potentially leading to compromised web content, defacement, or execution of malicious scripts. The vulnerability is classified as CWE\u201122 and carries a CVSS score of 5.1, indicating moderate risk. Public disclosure means an exploit is available for use against undisclosed or susceptible systems.", "risk_and_exploitability": "The exploit can be launched remotely through the web interface\u2019s save endpoint, and the EPSS score is less than 1\u202f%, implying low to moderate probability of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in the wild as of the latest data. However, given the public availability of exploit code and the lack of response by the vendor, an attacker could reasonably exploit the flaw to place arbitrary files if the application is reachable over the network. The risk is limited to the data and files that the web application can write; if the directory permissions are restricted, the damage could be contained to the webroot or administered directories."}}}}, "created": "2026-01-19T09:18:54.079650+00:00", "updated": "2026-04-18T05:30:25.852467+00:00", "vendors": ["sanluan", "sanluan$PRODUCT$publiccms"]}