CVE-2026-8740: Sanluan PublicCMS RCE Vulnerability

CVE-2026-8740 Overview

CVE-2026-8740 is a server-side template injection vulnerability in Sanluan PublicCMS version 5.202506.d. The flaw resides in the execute function of publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java, which handles the templateResult API. An authenticated attacker can manipulate the templateContent argument to inject template engine directives that the application fails to neutralize. The vulnerability is classified under [CWE-791: Incomplete Filtering of Special Elements]. According to public disclosure records, the vendor was contacted prior to publication but did not respond.

Critical Impact

Authenticated remote attackers can inject template engine syntax via the templateContent parameter, leading to limited confidentiality, integrity, and availability impact on the affected application.

Affected Products

• Sanluan PublicCMS 5.202506.d
• Component: templateResult API
• File: publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java

Discovery Timeline

• 2026-05-17 - CVE-2026-8740 published to NVD
• 2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8740

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements processed by a template engine. The execute method in TemplateResultDirective.java accepts the templateContent argument and passes it directly to the template rendering pipeline. PublicCMS uses a FreeMarker-style template engine, where unsanitized directives can alter template execution flow. An attacker with low-privilege authenticated access can submit crafted template syntax through the templateResult API and trigger evaluation server-side. Public exploit material has been released, increasing the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is incomplete input filtering inside the execute function. The templateContent parameter is treated as trusted template source rather than untrusted user input. Because the rendering routine does not strip or escape special template tokens, attacker-controlled directives flow into the engine without sanitization. This category of flaw maps to [CWE-791], where the filter set fails to cover all dangerous constructs accepted by the downstream parser.

Attack Vector

Exploitation requires network access to the PublicCMS application and valid low-privilege credentials. The attacker issues a request to the templateResult endpoint with a crafted templateContent body containing template engine syntax. The server evaluates the directives during rendering, returning attacker-influenced output. No user interaction is required. Because public proof-of-concept material exists on third-party platforms, defenders should assume the attack pattern is known. See the VulDB advisory for CVE-2026-8740 for additional technical context.

Detection Methods for CVE-2026-8740

Indicators of Compromise

• HTTP requests to the templateResult API endpoint containing template directive syntax such as ${...}, <#assign>, or <#include> inside the templateContent parameter.
• Unexpected outbound connections or file reads originating from the PublicCMS Java process shortly after templateResult requests.
• Application log entries showing template rendering errors tied to unusual templateContent payloads.

Detection Strategies

• Inspect web server and application logs for POST requests to templateResult containing template metacharacters in request bodies.
• Deploy web application firewall rules that flag template engine syntax submitted to API parameters from authenticated user sessions.
• Correlate authenticated PublicCMS sessions with anomalous child process creation or file system access from the Java runtime.

Monitoring Recommendations

• Forward PublicCMS access and application logs to a centralized analytics platform and alert on templateResult calls with non-standard payload sizes.
• Track authentication events for low-privilege accounts that subsequently invoke the templateResult API.
• Baseline normal template directive usage and alert on directives originating from non-administrative roles.

How to Mitigate CVE-2026-8740

Immediate Actions Required

• Restrict access to the templateResult API to trusted administrative networks until a vendor patch is available.
• Revoke or audit low-privilege accounts that have access to template-related functionality.
• Place the PublicCMS instance behind a reverse proxy or WAF that filters template engine metacharacters in request bodies.

Patch Information

At the time of publication, no vendor patch has been released. Public disclosure notes that Sanluan did not respond to coordinated disclosure attempts. Track the VulDB entry for CVE-2026-8740 and the upstream PublicCMS repository for any future fixes.

Workarounds

• Disable the templateResult directive endpoint if it is not required for production workflows.
• Apply strict allow-list filtering on the templateContent parameter at a proxy layer to reject template syntax tokens such as ${, <#, and <@.
• Enforce least privilege for CMS user roles and prohibit non-administrative accounts from invoking template rendering APIs.
• Isolate the PublicCMS Java process with operating system controls that limit file system and outbound network access.