CVE-2026-3289: PublicCMS Path Traversal Vulnerability

CVE-2026-3289 Overview

A path traversal vulnerability has been identified in Sanluan PublicCMS version 6.202506.d. This security flaw affects the saveMetadata function within the TemplateCacheComponent.java file, which is part of the Template Cache Generation component. The vulnerability allows attackers to manipulate file paths, potentially enabling unauthorized access to files outside the intended directory structure. This weakness can be exploited remotely, and exploit details have been made publicly available.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to access, read, or potentially modify files outside the designated template cache directory, which could lead to information disclosure or further system compromise.

Affected Products

• Sanluan PublicCMS version 6.202506.d
• PublicCMS Template Cache Generation component
• TemplateCacheComponent.java - saveMetadata function

Discovery Timeline

• 2026-02-27 - CVE-2026-3289 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3289

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The flaw exists in the Template Cache Generation component of PublicCMS, specifically within the saveMetadata function in TemplateCacheComponent.java.

The vulnerability allows an authenticated attacker to craft malicious input that escapes the intended directory boundaries. By manipulating path parameters, an attacker can traverse directory structures using sequences like ../ to access files outside the designated template cache location. This network-accessible attack requires low privileges but can impact the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the saveMetadata function. The function fails to properly validate user-supplied path components before using them in file system operations. Without adequate path canonicalization and boundary checks, malicious path traversal sequences embedded in metadata parameters can bypass intended directory restrictions.

Attack Vector

The attack vector for CVE-2026-3289 is network-based and can be executed remotely against vulnerable PublicCMS installations. An attacker with low-level authentication can exploit this vulnerability by:

1. Identifying the template cache generation endpoint
2. Crafting a request containing path traversal sequences (e.g., ../../) in metadata parameters
3. Submitting the malicious request to the saveMetadata function
4. Accessing or manipulating files outside the intended template cache directory

The vulnerability mechanism involves improper handling of file path parameters in the saveMetadata function. When processing template metadata, the function constructs file paths using user-controllable input without adequate validation. Attackers can inject directory traversal sequences to escape the template cache directory and access arbitrary files on the system. For detailed technical analysis, see the Yuque Document Analysis or the VulDB entry #348017.

Detection Methods for CVE-2026-3289

Indicators of Compromise

• HTTP requests to PublicCMS template endpoints containing ../ or ..%2F sequences in parameters
• Unusual file access patterns in web server logs targeting the TemplateCacheComponent endpoints
• Unexpected file modifications or access attempts outside the template cache directory
• Error logs indicating failed file operations with path traversal attempts

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Monitor application logs for requests to template-related endpoints with suspicious path components
• Deploy SentinelOne Singularity to detect anomalous file system access patterns indicative of path traversal exploitation
• Review access logs for requests containing encoded traversal sequences (%2e%2e%2f, %252e%252e%252f)

Monitoring Recommendations

• Enable verbose logging for the PublicCMS template cache component to capture all file operations
• Configure file integrity monitoring (FIM) on sensitive directories outside the template cache path
• Set up alerts for any requests to TemplateCacheComponent endpoints containing unusual characters or sequences
• Monitor for process behavior anomalies that indicate successful path traversal exploitation

How to Mitigate CVE-2026-3289

Immediate Actions Required

• Review and audit all PublicCMS installations for version 6.202506.d
• Implement network-level access controls to restrict access to the template management functionality
• Deploy WAF rules to filter requests containing path traversal patterns
• Consider disabling the template cache functionality until a patch is available

Patch Information

As of the last available information, the vendor (Sanluan/PublicCMS) was contacted about this vulnerability but did not respond. Organizations should monitor the PublicCMS project for official security updates and patches. In the absence of an official fix, implementing the workarounds below is strongly recommended.

Workarounds

• Implement strict input validation at the application or WAF level to reject any path components containing traversal sequences
• Restrict access to template management functions to trusted administrators only, using network segmentation or IP whitelisting
• Deploy SentinelOne endpoint protection to detect and block exploitation attempts in real-time
• Consider running PublicCMS in a containerized environment with strict filesystem access controls to limit the impact of successful exploitation

# Example WAF rule for ModSecurity to block path traversal attempts
SecRule REQUEST_URI|ARGS|ARGS_NAMES "@contains ../" \
    "id:1001,\
    phase:2,\
    block,\
    msg:'Path Traversal Attempt Detected - CVE-2026-3289',\
    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\
    severity:'CRITICAL'"