CVE-2026-1111
Published: 18 January 2026
Summary
CVE-2026-1111 is a medium-severity Path Traversal (CWE-22) vulnerability in Publiccms Publiccms. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 45.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-1111, published on 2026-01-18, is a path traversal vulnerability (CWE-22) in Sanluan PublicCMS versions up to 5.202506.d. The flaw affects the Save function in the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java within the Task Template Management Handler component, where manipulation of the 'path' argument enables directory traversal.
The vulnerability carries a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) and can be exploited remotely. Attackers require high privileges to launch the attack, potentially achieving limited impacts such as partial disclosure of confidential information, minor file modifications, or low-level disruption of availability through unauthorized file access outside the intended paths.
Advisories from sources like VulDB and GitHub indicate the exploit has been publicly disclosed and may be in use, with references including proof-of-concept details. The vendor was contacted early but provided no response, and no patches or mitigations are detailed in available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3185
Vulnerability details
A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in Save function enables arbitrary local file read (T1005) and potential web shell deployment via template writes (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the 'path' argument in TaskTemplateAdminController.Save to reject traversal sequences before any file write occurs.
Enforces authorization checks on file-system operations so that even an authenticated admin request cannot access paths outside the intended template directory.
Monitors file-system access patterns and can alert on anomalous path traversals originating from the Task Template Management endpoint.