A vulnerability was found in Sanluan PublicCMS 5.202506.d and classified as critical. The affected element is the function
.
getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key.
This vulnerability is identified as CVE-2026-8739. The attack can be executed remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
