A path traversal vulnerability exists in the Save function of TaskTemplateAdminController within Sanluan PublicCMS. By manipulating the input path argument, an attacker can cause the application to write files outside the intended directory. This can enable the creation or overwriting of arbitrary files on the webroot or other writable locations, potentially leading to compromised web content, defacement, or execution of malicious scripts. The vulnerability is classified as CWE‑22 and carries a CVSS score of 5.1, indicating moderate risk. Public disclosure means an exploit is available for use against undisclosed or susceptible systems.

Sanluan PublicCMS versions up to 5.202506.d are affected. No additional version data is provided, so all installations of the product released through this date remain vulnerable unless updated. The specific component impacted is the Task Template Management Handler implemented in com/publiccms/controller/admin/sys/TaskTemplateAdminController.java.

The exploit can be launched remotely through the web interface’s save endpoint, and the EPSS score is less than 1 %, implying low to moderate probability of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in the wild as of the latest data. However, given the public availability of exploit code and the lack of response by the vendor, an attacker could reasonably exploit the flaw to place arbitrary files if the application is reachable over the network. The risk is limited to the data and files that the web application can write; if the directory permissions are restricted, the damage could be contained to the webroot or administered directories.