CVE-2026-5987
Improper Neutralization in Sanluan PublicCMS FreeMarker Allows Remote Attack
Publication date: 2026-04-09
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sanluan | publiccms | to 6.202506.d (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1336 | The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. |
| CWE-791 | The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Sanluan PublicCMS up to version 6.202506.d, specifically in the function AbstractFreemarkerView.doRender within the FreeMarker Template Handler component. It involves improper neutralization of special elements used in the template engine, which can be manipulated remotely by an attacker.
How can this vulnerability impact me? :
The vulnerability allows remote attackers to exploit the improper neutralization of special elements in the template engine, potentially leading to unauthorized actions or information disclosure. The exact impact depends on the context of use, but it may compromise the integrity and confidentiality of the affected system.