The vulnerability occurs in the getSignKey method of Sanluan PublicCMS, where manipulation of the privatefile_key parameter causes the application to use a hard‑coded cryptographic key. Because the key is embedded in source code, an attacker who can control the parameter can obtain the secret and use it to decrypt protected data or forge signatures, thereby potentially compromising confidentiality and integrity. The CVSS score of 6.9 classifies it as a medium‑severity flaw.

The flaw affects the 5.202506.d release of PublicCMS published by Sanluan. No other affected versions are listed in the official CNA data, and therefore the risk is confined to that specific build unless similar code patterns exist in other releases.

The exploit is remote and publicly available. While the EPSS score is not disclosed, the medium CVSS score indicates that once discovered, the vulnerability can be leveraged with moderate effort. Because the key is hard‑coded, an attacker need only supply the manipulated privatefile_key value to obtain the key, making the attack straightforward for anyone with network access to the application.