The flaw resides in the SafeConfigComponent.getSafeUrl method of the Pay Endpoint component. The implementation accepts a returnUrl argument without proper validation, allowing an attacker to craft a URL that redirects victims to arbitrary destinations. Once triggered, the victim’s browser follows the supplied URL, potentially leading to phishing websites or malicious payloads. This omission results in an Open Redirect vulnerability, classified under CWE‑601.

PublicCMS PublicCMS, versions prior to and including 5.202608.a. The vulnerability is present in the publiccms-core module of PublicCMS. No other product or version information was disclosed.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, so the likelihood of exploitation cannot be precisely quantified. The issue is not listed in the CISA KEV catalog. Attackers can exercise the flaw remotely by invoking the Pay Endpoint with a crafted returnUrl. Because the redirect is unconstrained, malicious users can encourage users to visit arbitrary sites. The vulnerability is exploitable as described, and the lack of vendor response means an unpatched system remains vulnerable.