The vulnerability exists in Sanluan PublicCMS up to version 6.202506.d, where the log_login function in the Failed Login Handler writes the errorPassword argument to a file in plaintext. This causes sensitive authentication data to be exposed in log files, allowing an attacker who can read those logs to recover password information and potentially reuse those credentials elsewhere. The confidentiality of user credentials is thus compromised.

Affecting Sanluan PublicCMS versions 6.202506.d and earlier, the issue resides in the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java, specifically the log_login method that handles failed login attempts and writes password arguments to disk. Any deployment with that version or earlier is susceptible.

The CVSS score is 5.3, indicating medium severity. An attacker can trigger the flaw remotely by manipulating the errorPassword argument during a login attempt, which results in benign log entries containing plaintext passwords. While exploitation requires the ability to read the log files, the persistent nature of file storage means the data remains exposed until proper mitigation is applied. The vulnerability is not listed in CISA KEV and no exploit score is available, but the remote trigger and sensitive data leakage raise a moderate confidentiality risk.