Sanluan PublicCMS CVE-2025-7953

Exploitation requires three specific conditions: the attacker must first authenticate to the PublicCMS application (PR:L), must craft a malicious URL with the File parameter targeting the viewer.html component, and the victim user must click or interact with the malicious link (UI:P). The vulnerability is not exploitable against unauthenticated users or without user interaction. Non-default deployment configurations with access controls on the PDF viewer may further restrict exploitation scope.

Despite the CVSS 4.0 score suggesting moderate severity, multiple risk signals indicate this is a lower-priority vulnerability in practice. The EPSS score of 0.07% (21st percentile) indicates very low exploitation likelihood compared to other vulnerabilities. The CVSS vector reveals critical limiting factors: authentication is required (PR:L), user interaction is mandatory (UI:P), and the scope is unchanged with no confidentiality or availability impact (VC:N/VI:L/VA:N/SC:N/SI:N/SA:N). The integrity impact is limited (VI:L) due to the redirect nature rather than direct data compromise. While publicly available exploit code exists (POC marked as available), the combination of authentication requirement, user interaction dependency, and low EPSS score suggests this is not a priority compared to network-accessible unauthenticated exploits. The patch has been available since the disclosure, further reducing active risk. This is a textbook example of a vulnerability with higher CVSS than real-world exploitability warrants.

An authenticated attacker crafts a malicious link containing a specially crafted File parameter pointing to an external website, then shares this link with a victim user within the PublicCMS application. When the victim clicks the link in the PDF viewer, they are redirected to the attacker's site, which could be used for phishing, credential harvesting, or malware distribution. The publicly available exploit code on GitHub demonstrates the feasibility of this attack.