PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8739 Sanluan CVE debrief

CVE-2026-8739 describes a remote flaw in Sanluan PublicCMS 5.202506.d where the getSignKey function in SafeConfigComponent.java can be manipulated via the privatefile_key argument to cause use of a hard-coded cryptographic key. The supplied source also states that an exploit is public and that the vendor was contacted early but did not respond. NVD/CVSS data in the source rates the issue as medium severity with network reachability, no privileges, no user interaction, and low integrity impact.

Vendor
Sanluan
Product
PublicCMS
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-17
Original CVE updated
2026-05-18
Advisory published
2026-05-17
Advisory updated
2026-05-18

Who should care

Administrators and operators running Sanluan PublicCMS 5.202506.d, especially on internet-facing systems or any deployment that uses the affected private file/configuration path or relies on the key-handling logic in SafeConfigComponent.

Technical summary

The affected code path is getSignKey in publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. Per the source description, manipulating privatefile_key can force the application to use a hard-coded cryptographic key, matching CWE-320/CWE-321. The supplied CVSS 4.0 vector indicates a remotely reachable issue with no authentication or user interaction required and low integrity impact.

Defensive priority

Medium, but act promptly if PublicCMS is exposed to the internet or used to protect sensitive content; the source says a public exploit exists.

Recommended defensive actions

  • Inventory all PublicCMS deployments and confirm whether any instance is running version 5.202506.d.
  • Reduce exposure of PublicCMS management and private-file functionality until the issue is remediated; restrict access to trusted networks where possible.
  • Track the official CVE/NVD record and the VulDB references for any vendor fix, mitigation, or updated guidance.
  • If you cannot patch immediately, treat any hard-coded or embedded key material as suspect and plan credential/secret rotation where it protects sensitive data.
  • Review logs and authentication/configuration activity for unexpected requests involving the affected configuration path after the disclosure date.
  • Prioritize replacement or remediation on systems that are internet-facing or that store sensitive private files or configuration data.

Evidence notes

The source corpus identifies CVE-2026-8739 as published on 2026-05-17 and modified the same day. It names Sanluan PublicCMS 5.202506.d, the getSignKey function in SafeConfigComponent.java, and the privatefile_key argument. The supplied CNA/VulDB metadata assigns CWE-320 and CWE-321 and a CVSS:4.0 vector with network attack, no privileges, no user interaction, and low integrity impact. The corpus does not include a KEV listing or an independent confirmation of exploitation beyond the source statement that a public exploit exists.

Official resources

The supplied source states that the vendor was contacted early and did not respond, and that a public exploit is available. No CISA KEV listing is present in the provided corpus, and the source does not include a vendor patch notice.