CVE-2026-3289 is a medium severity path traversal in Sanluan PublicCMS 6.202506.d, scored CVSS 6.3. The saveMetadata function in the template cache component can be manipulated to reach paths outside its folder. The record says the vendor did not respond, so no fix is confirmed. Restrict access and watch for a patch.
What's affected
The NVD record names Sanluan PublicCMS 6.202506.d, the saveMetadata function in TemplateCacheComponent.java, and the template cache generation component. It says the attack can be executed remotely and that an exploit is public.
The vendor was contacted and did not respond, according to the record. No fixed version is listed.
How to check if you're exposed
Check the PublicCMS version shown in your deployment against 6.202506.d.
Then look at who can use template related features. Features that manage templates are usually admin only, so start by listing your admin accounts and where the admin interface is reachable from.
Review the web server and application logs for template save requests with unusual path values.
What to do now
- Restrict the PublicCMS admin interface to a VPN or allowlisted addresses.
- Review admin accounts and remove the ones you do not need.
- Run the application with a user that can write only to the directories it needs.
- Check the project repository for a newer release and apply it when one appears.
- Consider a web application firewall rule that rejects dot dot segments in request parameters.
Why it matters
The class is CWE-22, path traversal. A file path built from user input must be resolved and checked to stay inside an allowed folder. When it is not, a request can read or write elsewhere on the server.
The medium score reflects limited scope in the vector. Even so, public exploit details and no response from the vendor mean you should plan compensating controls. The record's KEV flag is false.
Quick check
Is a patched version available?
None is confirmed in the record. Check the project repository and release page directly.
Sources
Last reviewed: 19 October 2026.
