PublicCMS CVE-2026-6797

Exploitation requires a valid low-privilege user account on the PublicCMS instance, as confirmed by PR:L in the CVSS 4.0 vector - unauthenticated exploitation is not indicated. The vulnerable code path is activated specifically through the document-to-HTML conversion feature (DocToHtmlUtils.java), meaning the attacker must have access to a document submission or conversion function within the application; this feature may be restricted by user role depending on site configuration. Limiting factors: authentication is mandatory (not an unauthenticated internet-facing flaw); impact is availability-only with no confidentiality or integrity breach; SSVC classifies the attack as not automatable, making reliable mass exploitation unlikely; and impact is partial (VA:L), not a complete service takedown from a single request. No special non-default configuration has been identified as required beyond having the document conversion feature enabled.

The CVSS 4.0 score of 5.3 (Medium) reflects network accessibility with low complexity (AV:N/AC:L) but meaningful limiting factors: low-privilege authentication is required (PR:L), and impact is confined to partial availability degradation (VA:L) with no confidentiality or integrity effects. EPSS at 0.03% places this in the 10th percentile, indicating very low probability of opportunistic exploitation. SSVC corroborates: exploitation is none, the attack is classified as not automatable, and technical impact is only partial. There is no CISA KEV listing and no public exploit code identified at time of analysis. The authentication requirement (PR:L) is a meaningful barrier - this is not an unauthenticated internet-facing risk. The vendor's non-response to coordinated disclosure is a concern for long-term patch availability, but does not elevate near-term exploitation likelihood given the current signals. This vulnerability does not warrant emergency response priority; standard patch-cycle handling is appropriate unless the PublicCMS document conversion feature is exposed to untrusted authenticated users at scale.

A low-privileged authenticated PublicCMS user submits a specially crafted document - such as a zip-bomb-style archive engineered to produce a degenerate inflate ratio - to the platform's document conversion endpoint. The ZipSecureFile.setMinflateRatio function processes the attacker-controlled input without adequate resource constraints, causing the JVM to consume excessive CPU or heap memory during decompression. Repeated or concurrent submissions can degrade server availability for all users. No public exploit code has been identified, and reliable automation of this attack is not confirmed.