CVE-2026-3289
Received Received - Intake
Path Traversal in Sanluan PublicCMS Template Cache Component

Publication date: 2026-02-27

Last updated on: 2026-04-29

Assigner: VulDB

Description
A weakness has been identified in Sanluan PublicCMS 6.202506.d. This impacts the function saveMetadata of the file TemplateCacheComponent.java of the component Template Cache Generation. Executing a manipulation can lead to path traversal. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-27
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-02-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-3289
EUVD
EUVD-2026-8997
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
publiccms publiccms 6.202506.d
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Sanluan PublicCMS version 6.202506.d, specifically in the saveMetadata function of the TemplateCacheComponent.java file within the Template Cache Generation component.

The issue is a path traversal weakness that can be exploited remotely by manipulating inputs to the saveMetadata function. This allows an attacker to access files or directories outside the intended scope.

The exploit for this vulnerability has been publicly disclosed, and the vendor did not respond to early notifications about this issue.

Impact Analysis

Exploiting this vulnerability can allow an attacker to perform path traversal attacks remotely, potentially accessing or modifying files outside the intended directory.

This can lead to unauthorized disclosure of sensitive information, data tampering, or disruption of normal system operations.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart