A vulnerability has been discovered in Sanluan PublicCMS up to version 6.202506.d. The defect lies in the ZipSecureFile.setMinflateRatio method within DocToHtmlUtils.java, allowing an attacker to manipulate the minimum inflate ratio of ZIP streams. This manipulation consumes CPU and memory resources, resulting in a denial‑of‑service condition. The flaw can be triggered remotely, as the vulnerable function processes external ZIP inputs.

Affected systems are instances of Sanluan PublicCMS, specifically any installation running version 6.202506.d or earlier. No later versions have been documented to contain the issue.

The CVSS score for this vulnerability is 5.3, indicating a medium impact. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Because the attack vector is remote, an adversary could trigger the resource drain without local access. The known CWEs (CWE‑400 and CWE‑404) suggest that the attack is based on uncontrolled resource consumption and missing bounds checking. Although no public exploit code is currently available, the medium score and remote nature of the flaw warrant cautious monitoring and prompt patching.