PublicCMS EUVD-2026-24501

Q: What is the CVSS score of EUVD-2026-24501?

EUVD-2026-24501 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6797 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-21 VulDB

GHSA-f82q-cjhg-c837

Denial Of Service Java Publiccms Sanluan

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible but requires low-privilege authentication for document submission; impact is availability-only resource exhaustion with no confidentiality or integrity effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:37 vuln.today

CVSS changed

Apr 21, 2026 - 21:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24501

CVE Published

Apr 21, 2026 - 20:45 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in Sanluan PublicCMS up to 6.202506.d. Affected by this vulnerability is the function ZipSecureFile.setMinflateRatio of the file common/src/main/java/com/publiccms/common/tools/DocToHtmlUtils.java. Such manipulation leads to resource consumption. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Uncontrolled resource consumption in Sanluan PublicCMS versions 6.202506.a through 6.202506.d enables low-privileged remote attackers to trigger denial-of-service conditions by manipulating the ZipSecureFile.setMinflateRatio function within the document-to-HTML conversion utility DocToHtmlUtils.java. The flaw (CWE-400) causes the server to exhaust resources when processing attacker-controlled input through the affected code path. No public exploit exists, EPSS sits at 0.03% (10th percentile), SSVC confirms no known exploitation and non-automatable attack profile - real-world priority is low for most deployments, though the vendor's non-response to disclosure leaves patch status unresolved.

Technical ContextAI

PublicCMS is an open-source Java-based content management system developed by Sanluan. The vulnerability is rooted in com/publiccms/common/tools/DocToHtmlUtils.java, specifically the ZipSecureFile.setMinflateRatio function - a component involved in document-to-HTML conversion. ZipSecureFile is a security wrapper class (associated with Apache POI and similar document-processing libraries) designed to mitigate Zip Bomb attacks by enforcing a minimum inflate ratio threshold. Improper handling or manipulation of this parameter allows an attacker to supply input that bypasses or subverts the resource guard, causing uncontrolled CPU or memory consumption during decompression or conversion processing. CWE-400 (Uncontrolled Resource Consumption) is the root-cause class: the application fails to limit the quantity of resources it allocates in response to attacker input. The CPE cpe:2.3:a:sanluan:publiccms:*:*:*:*:*:*:*:* covers all PublicCMS releases through 6.202506.d per ENISA EUVD-2026-24501.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, leaving no official fix version confirmed. As an immediate compensating control, restrict access to document upload and conversion features to the minimum set of trusted, authenticated users, reducing the pool of accounts that can trigger the vulnerable ZipSecureFile.setMinflateRatio code path; note this does not eliminate risk from compromised or malicious insider accounts. Implement rate limiting on document submission and conversion endpoints to constrain the frequency of resource-exhaustion attempts; trade-off is potential friction for legitimate bulk document processing workflows. Enforce JVM-level resource caps (e.g., -Xmx heap limits, CPU throttling via container cgroups) to bound the blast radius if exploitation occurs; this may affect overall application throughput. Monitor VulDB (https://vuldb.com/vuln/358491) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-6797) for patch availability. Organizations with strict availability requirements should evaluate patching the DocToHtmlUtils.java code directly by setting an explicit, bounded minimum inflate ratio in ZipSecureFile, or replacing the document conversion feature with a hardened alternative.