PublicCMS CVE-2026-6796

Q: What is the CVSS score of CVE-2026-6796?

CVE-2026-6796 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24500 MEDIUM

Cleartext Storage in a File or on Disk (CWE-313)

2026-04-21 VulDB

Java Information Disclosure Publiccms Sanluan

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network trigger requires no auth (AV:N/AC:L), but log-file read to recover credentials implies existing privilege (PR:L); impact is confidentiality-only and limited in scope (C:L/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:40 vuln.today

CVSS changed

Apr 21, 2026 - 21:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24500

CVE Published

Apr 21, 2026 - 20:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java of the component Failed Login Handler. This manipulation of the argument errorPassword causes cleartext storage in a file or on disk. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (log_login in LoginAdminController.java) persists the raw errorPassword argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.

Technical ContextAI

PublicCMS is a Java-based open-source content management system developed by Sanluan. The vulnerability resides in the admin login controller at core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java, specifically in the log_login method that handles authentication failures. CWE-313 (Cleartext Storage in a File or on Disk) identifies the root cause: sensitive user-supplied input - the attempted password - is written directly to a persistent log or file without hashing, masking, or redaction. The CPE string cpe:2.3:a:sanluan:publiccms:*:*:*:*:*:*:*:* confirms all PublicCMS releases through version 6.202506.d are in scope. Because the login endpoint is network-accessible, any remote actor can trigger the log-write step, though recovery of logged credentials requires separate file-system access.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure. As a primary compensating control, administrators should modify the PublicCMS logging configuration or patch LoginAdminController.java locally to redact or replace the errorPassword value (e.g., substitute a fixed placeholder such as [REDACTED]) before the log write call. A secondary control is to restrict filesystem read permissions on PublicCMS application log directories to the minimum required service account, preventing lateral access by low-privilege users; note this does not eliminate the stored data but limits who can read it. Organizations should audit existing log files for accumulated plaintext passwords and rotate credentials for any accounts that may have been probed. Reference https://vuldb.com/vuln/358490 for ongoing disclosure updates.