CVE-2026-109160 PublicCMS CVE debrief

Who should care

Defenders responsible for PublicCMS deployments should assess exposure and prioritize verification of the affected version. Security teams should also be aware of the potential for phishing attacks using open redirects.

Why it matters

CVE-2026-109160 is a medium-severity vulnerability in PublicCMS that allows for open redirects, posing a risk to deployments. Defenders should verify exposure, implement input validation, and monitor for exploitation attempts.

• Phishing attacks can be amplified using open redirects, posing a risk to users of the PublicCMS pay Endpoint.
• Defenders need to verify the affected version of PublicCMS and implement input validation to prevent open redirects.
• The exploit has been publicly disclosed, increasing the likelihood of exploitation attempts.
• Remediation priority is moderate due to the medium CVSS score and the potential for phishing attacks.

Technical summary

The vulnerability in PublicCMS up to 5.202608.a allows for an open redirect in the SafeConfigComponent.getSafeUrl function of the pay Endpoint. This is achieved by manipulating the returnUrl argument. The attack can be launched remotely. Defenders should prioritize verifying the affected version of PublicCMS and assessing exposure, as the vulnerability allows for open redirects which can be used in phishing attacks. Implementing input validation and sanitization for the returnUrl argument can prevent open redirects. The exploit has been publicly disclosed, increasing the likelihood of exploitation attempts.

Defensive priority

Defenders should prioritize verifying the affected version of PublicCMS and assessing exposure, as the vulnerability allows for open redirects which can be used in phishing attacks.

Recommended defensive actions

• Verify the version of PublicCMS in use and compare it to the affected version 5.202608.a.
• Assess exposure to the pay Endpoint and the SafeConfigComponent.getSafeUrl function.
• Implement input validation and sanitization for the returnUrl argument to prevent open redirects.
• Monitor for publicly disclosed exploits and adjust defensive priorities accordingly.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the vulnerability in PublicCMS. However, the vendor did not respond to the disclosure, and there is limited information on affected versions beyond 5.202608.a.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.