PublicCMS CVE-2026-8740

Requires authenticated access with low-privilege credentials (PR:L from CVSS vector) to the PublicCMS application, specifically an account with permissions to invoke the templateResult API endpoint. The vulnerability is in the publiccms-core component's TemplateResultDirective.java, meaning exploitation depends on this API being accessible to authenticated users and the templateContent parameter being controllable. No special non-default configuration is required - the vulnerability exists in standard PublicCMS 5.202506.d installations where the templateResult directive is enabled (typical CMS deployment for content preview/rendering features). Exploitation is network-based (AV:N) with low attack complexity (AC:L), requiring no user interaction (UI:N), making it exploitable via direct API requests from any network location where the attacker can authenticate. Limiting factors: The PR:L requirement means attackers must first obtain valid credentials through phishing, credential stuffing, insider access, or chaining with separate authentication vulnerabilities. The confined scope (S:U) suggests exploitation impact is limited to the application's security context rather than underlying operating system or adjacent systems, though SSTI vulnerabilities can sometimes escalate privileges beyond initial sandbox assumptions.

Real-world risk is MODERATE-HIGH despite the 6.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-exploitable vulnerability with low complexity requiring only low-privileged authentication and no user interaction, affecting confidentiality, integrity, and availability at low impact levels. However, SSTI vulnerabilities frequently escalate beyond their initial CVSS ratings because template engines often have access to application internals, filesystem operations, and code execution primitives. The E:P (Proof-of-Concept Exploit exists) temporal metric confirms weaponized exploit code is publicly available via VulnPlus, significantly lowering the skill barrier for exploitation. The RL:X (Remediation Level: Unknown) reflects vendor non-responsiveness, meaning no official patch exists and users lack vendor-supported mitigation paths. The attack requires authentication (PR:L), which reduces exposure compared to unauthenticated vulnerabilities, but CMS platforms often have legitimate user accounts (content editors, contributors) whose credentials could be compromised or abused by malicious insiders. The confined scope (S:U) limits blast radius to the vulnerable component's security context, but SSTI can often break out of intended sandboxes. EPSS data not provided, so mass exploitation probability cannot be assessed. Not listed in CISA KEV, suggesting targeted rather than widespread active exploitation. Decision priority: Organizations running PublicCMS 5.202506.d with authenticated users should treat this as HIGH priority given public exploit availability, vendor silence, and SSTI's well-documented escalation potential. Organizations without this specific version or with strong authentication controls can deprioritize.

An attacker with low-privileged authenticated access to PublicCMS (such as a compromised content editor account or malicious insider) sends a crafted HTTP request to the templateResult API endpoint, injecting malicious template engine syntax into the templateContent parameter. The vulnerable TemplateResultDirective.java execute function processes this input without sanitization, causing the template engine to interpret and execute the attacker's injected directives during server-side rendering. This enables the attacker to read sensitive configuration files, exfiltrate database credentials, execute system commands with the application's privileges, or manipulate CMS content to inject malicious scripts for other users. Publicly available exploit code at VulnPlus (https://vulnplus-note.wetolink.com/share/ILcCnOvJ1fMc) provides ready-to-use proof-of-concept, enabling even low-skill attackers to weaponize the vulnerability once they obtain authenticated access through credential theft, social engineering, or exploitation of separate authentication bypass vulnerabilities.