PublicCMS EUVD-2026-98454

Exploitation targets the 'pay' endpoint and specifically the returnUrl argument processed by SafeConfigComponent.getSafeUrl; the attacker must supply a crafted returnUrl value and induce a victim to follow the link and interact with the flow (UI:P/UI:R). No authentication is required (PR:N), but success depends on social engineering - a user must click the attacker-supplied link - and the impact is limited to browser redirection (Low integrity, no server compromise). Limiting factors: requires victim interaction, affects only PublicCMS deployments exposing the pay endpoint, and versions up to 5.202608.a.

This is a low-priority issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N, base 2.1) indicates a network-reachable, low-complexity, unauthenticated flaw, but one that requires passive user interaction (UI:P) and yields only a Low integrity impact with no confidentiality or availability impact and no scope change - consistent with CWE-601 open redirect. The SSVC/threat signals reinforce a low urgency: E:P indicates only a proof-of-concept exploitation state (not active exploitation), there is no CISA KEV listing, and EPSS was not provided. A publicly disclosed exploit exists, which raises opportunistic phishing risk, but the technical impact is confined to redirecting a victim's browser rather than compromising the server. The only cross-signal tension is that an open redirect inherently abuses the victim's trust/browser, yet the vendor-assigned 4.0 vector marks all subsequent-system metrics (SC/SI/SA) as None - a defensible but conservative modeling choice. Overall this is a genuine-but-minor web weakness, not a widespread server-compromise threat.

An attacker crafts a URL to the PublicCMS pay endpoint with a malicious returnUrl value pointing to an attacker-controlled site, then delivers it via phishing email or a link. When a victim clicks and interacts with the flow, the application redirects their browser to the attacker's domain, enabling credential-harvesting or malware-landing pages under the guise of the trusted PublicCMS host. A proof-of-concept has been publicly disclosed, lowering the barrier to abuse.