CVE-2026-8739: medium-severity vulnerability in Sanluan PublicCMS
Sanluan PublicCMS SafeConfigComponent.java getSignKey hard-coded key
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.3%
A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key
. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Sanluan · PublicCMSpublic PoCs found — 1
cve_referencevulnplus-note.wetolink.com/share/PCVUlOncmwTCunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sanluan PublicCMS
In the same product, most dangerous first.
CVE-2026-3289MEDIUMSanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalEPSS 0.8%CVE-2026-1111MEDIUMSanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversalEPSS 0.7%CVE-2026-1112MEDIUMSanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorizationEPSS 0.4%CVE-2026-8737MEDIUMSanluan PublicCMS Trade Address Query TradeAddressListDirective.java execute missing authenticationEPSS 0.4%CVE-2024-11070MEDIUMSanluan PublicCMS Tag Type save cross site scriptingEPSS 0.4%CVE-2025-7953MEDIUMSanluan PublicCMS viewer.html redirectEPSS 0.4%