CVE-2026-8739 Details
Description
A vulnerability was detected in Sanluan PublicCMS 5.202506.d. The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key . The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Sanluan PublicCMS version 5.202506.d, specifically within the SafeConfigComponent's getSignKey function. The issue arises because the privatefile_key argument is manipulated, leading to the use of a hard-coded cryptographic key. This vulnerability allows remote attackers to bypass private file access controls and download restricted files without authentication, as the default signing key can be predicted and forged. The problem is exacerbated by the exposure of the cluster identifier through an unauthenticated API, which can be used to derive the signing key offline.
To address this vulnerability, it is recommended to require a high-entropy, randomly generated privatefile_key for each site during installation. Remove predictable fallback keys based on public values and avoid exposing internal identifiers that could assist in key derivation. Additionally, replace the current signing mechanism with HMAC-based signing using a strong secret key, rotate existing private file signing keys, and invalidate historical signed URLs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/809917 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364327 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364327/cti | [email protected] | AdvisoryPermission Required |
| https://vulnplus-note.wetolink.com/share/PCVUlOncmwTC | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-320 | Key Management Errors | [email protected] |
| CWE-321 | Use of Hard-coded Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sanluan PublicCMS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 17, 2026 | New CVE Received | [email protected] |