PublicCMS CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM PublicCMS CVE published 2026-10-13

CVE-2026-109160

A vulnerability was determined in PublicCMS up to 5.202608.a, specifically in the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. This issue allows for an open redirect by manipulating the argument returnUrl. The attack can be launched remotely, and the exploit has been publicly disclosed.