{"id":"CVE-2026-1111","aliases":["EUVD-2026-3185","GHSA-jc4q-h995-9f9w"],"status":"published","title":"Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00696,"percentile":0.53278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-01-18T05:32:05Z","modified":"2026-10-28T02:31:07Z","exploits":[{"source":"pocgithub","id":"George0Papasotiriou/CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy","title":"George0Papasotiriou/CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy","date":"2026-08-03","url":"https://github.com/George0Papasotiriou/CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy"}],"products":[{"vendor":"publiccms","product":"publiccms"},{"vendor":"sanluan","product":"publiccms"}],"references":[{"url":"https://vuldb.com/?id.341703","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.341703","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.732726","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/AnalogyC0de/public_exp/issues/2","tags":["exploit","issue-tracking","Exploit","Issue Tracking","Mitigation","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1111","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jc4q-h995-9f9w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1111.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1111","title":"Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2026-01-18T05:32:05.496Z","modified":"2026-02-23T08:36:16.524Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","level":"medium","assessor":"cna"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-3185","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2026-01-18T05:32:05Z","modified":"2026-02-23T08:36:16Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:35.089821Z"}],"ghsa":[{"id":"GHSA-jc4q-h995-9f9w","title":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function...","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2026-01-18T06:30:23Z","modified":"2026-01-18T06:30:26Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:05:39.318179Z"}],"nvd":[{"id":"CVE-2026-1111","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2026-01-18T06:16:01.007Z","modified":"2026-06-17T10:15:00.943Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:L/Au:M/C:P/I:P/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-1111","title":"Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal","description":"A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","status":"published","published":"2026-01-18T05:32:05.496Z","modified":"2026-10-28T02:31:07.890014937Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:55.61515Z"}]}}