CVE-2026-109160
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 12, 2026
Description
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-601 Open Redirect
Affected Products
| Product | Versions |
|---|---|
PublicCMSn/a |
|
References
- VDB-416891 | PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirectvdb-entrytechnical-description
- VDB-416891 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-109160 | CVE Analysis and Reportthird-party-advisory
- Submit #979787 | PublicCMS V5 (V5.202608.a and earlier); V4.0 line also supported open redirect (CWE-601)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.