CVE-2026-1111 Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal
Remote attackers with permissions can exploit a path traversal flaw in PublicCMS task template management to read or modify arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-1111?
CVE-2026-1111 is a medium-severity path traversal vulnerability in Sanluan PublicCMS, published on 18 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-22
Which versions are affected by CVE-2026-1111?
It affects 1 product.
Products include Publiccms Publiccms.
How do I fix CVE-2026-1111?
No fix has been published for CVE-2026-1111 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-1111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-1111 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Sanluan PublicCMS
Sources
Also known as GHSA-jc4q-h995-9f9w.