CVE-2026-8740 Details

A server-side template injection vulnerability has been identified in Sanluan PublicCMS version 5.202506.d. The issue arises in the TemplateResult API, specifically within the execute function of the TemplateResultDirective class. This vulnerability allows authenticated users with low-privilege app tokens to bypass authorization checks and access sensitive server information. The flaw is caused by the direct evaluation of user-controlled template content in the FreeMarker template engine, without proper authorization enforcement. Exploitation is possible by embedding calls to internal directives that disclose server properties or disk information.

To address this vulnerability, do not evaluate externally supplied templates using the full web FreeMarker configuration. Instead, use a dedicated sandboxed FreeMarker configuration for the 'templateResult' API, removing or strictly allowing shared variables. Implement a strict 'TemplateClassResolver' to disable access to internal directives and methods from user-controlled templates. Additionally, ensure that authorization checks are enforced in the template execution path, similar to the existing HTTP-layer checks. If 'templateResult' is meant for internal use only, disable it by default for external integrations or limit it to trusted administrative contexts.