CVE-2026-109160: PublicCMS Open Redirect Vulnerability

CVE-2026-109160 Overview

CVE-2026-109160 is an open redirect vulnerability in PublicCMS versions up to 5.202608.a. The flaw resides in the SafeConfigComponent.getSafeUrl function within publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java, specifically in the pay endpoint component. Attackers can manipulate the returnUrl argument to redirect users to arbitrary external destinations. The vulnerability is remotely exploitable without authentication and requires user interaction to trigger. The exploit has been publicly disclosed. The vendor was contacted prior to public disclosure but did not respond. This weakness is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can craft malicious links that appear to originate from a trusted PublicCMS instance, redirecting victims to attacker-controlled sites for phishing or malware delivery.

Affected Products

PublicCMS versions up to and including 5.202608.a
Component: pay endpoint
File: publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java

Discovery Timeline

2026-10-13 - CVE-2026-109160 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109160

Vulnerability Analysis

The vulnerability affects the getSafeUrl method inside SafeConfigComponent, which is intended to validate URLs supplied through the returnUrl parameter on the pay endpoint. The validation logic fails to properly restrict the destination domain, allowing attacker-supplied URLs to pass through as redirect targets. When a user follows a crafted link containing a malicious returnUrl value, the application issues an HTTP redirect to the external host.

Open redirect flaws are commonly chained with phishing campaigns. Victims see a legitimate PublicCMS domain in the initial link, which lowers suspicion before the browser lands on an attacker-controlled page that may harvest credentials or deliver malware.

The PublicCMS vendor did not respond to disclosure attempts, so an official patched release addressing CVE-2026-109160 has not been published at the time of writing.

Root Cause

The root cause is insufficient allowlist validation of the returnUrl parameter in SafeConfigComponent.getSafeUrl. The function does not strictly compare the supplied URL against a set of permitted internal hosts or relative paths before issuing a redirect, violating the guidance of [CWE-601].

Attack Vector

An attacker crafts a URL pointing to the vulnerable pay endpoint of a target PublicCMS deployment and sets the returnUrl query parameter to an external, attacker-controlled address. The attacker then distributes the link through email, chat, or social media. When the victim clicks the link and completes the required interaction on the pay endpoint, the server issues a redirect that forwards the browser to the attacker's host.

Technical specifics of exploitation are documented in the VulDB CVE-2026-109160 entry and the associated VulDB vulnerability record.

Detection Methods for CVE-2026-109160

Indicators of Compromise

Web server access logs showing requests to the PublicCMS pay endpoint with returnUrl parameters pointing to external domains
HTTP 302 or 301 responses from the pay endpoint whose Location header references hosts outside the organization's allowlist
Spikes in redirect responses from PublicCMS correlated with inbound phishing campaigns referencing the same domain

Detection Strategies

Parse application logs for the returnUrl query parameter and alert when values do not match a defined set of trusted internal hostnames or relative paths
Deploy a web application firewall rule that inspects requests to the pay endpoint and blocks returnUrl values containing absolute URLs with external schemes or hosts
Monitor outbound referral patterns reported by threat intelligence to identify PublicCMS instances being abused as redirectors

Monitoring Recommendations

Centralize PublicCMS web server and application logs in a SIEM for query across the pay endpoint and returnUrl activity
Build a dashboard tracking unique external destinations observed in redirect responses from PublicCMS over time
Alert security operations when any PublicCMS URL appears in user-reported phishing submissions

How to Mitigate CVE-2026-109160

Immediate Actions Required

Restrict public exposure of the PublicCMS pay endpoint where feasible until a vendor fix is available
Implement a reverse proxy or web application firewall rule to reject requests whose returnUrl parameter contains an absolute URL to any host outside the organization's allowlist
Inform users and customers that PublicCMS-hosted links containing returnUrl parameters may be abused for phishing redirection

Patch Information

No vendor patch has been published at the time of this writing. The vendor was contacted prior to disclosure but did not respond. Monitor the official PublicCMS project repository for future releases that address SafeConfigComponent.getSafeUrl and update immediately when a fixed version becomes available. Additional tracking details are available at the VulDB submission record.

Workarounds

Modify SafeConfigComponent.getSafeUrl locally to enforce a strict allowlist of permitted redirect targets, treating any absolute URL whose host is not on the list as invalid
Replace absolute redirect targets with server-side mapping tokens so that user input never directly determines the redirect destination
Add a visible interstitial page that warns users when a redirect leaves the PublicCMS domain, reducing the effectiveness of phishing chains

bash

# Example nginx rule to block external returnUrl values on the pay endpoint
location /pay {
    if ($arg_returnUrl ~* "^(https?:)?//(?!trusted\.example\.com)") {
        return 400;
    }
    proxy_pass http://publiccms_backend;
}