A flaw in the execute method of TemplateResultDirective.java allows the templateContent argument to be injected with improperly neutralized template elements. The vulnerability enables an attacker to manipulate the template engine’s processing logic, which can lead to remote code execution or other disruptive actions. The weakness matches CWE‑1336 (Improper Control of a Resource Through an Unchecked Parameter) and CWE‑791 (Uncontrolled Memory Allocation).

Only Sanluan PublicCMS 5.202506.d is affected. No other product versions or components are listed, so deployments running exactly this release carry the risk.

The CVSS score of 5.3 signals moderate severity. EPSS information is not available and the vulnerability is not in the CISA KEV catalog, indicating no known widespread exploitation yet. The attack vector is remote, as the flaw is triggered via a web‑facing endpoint and an exploit has already been published, allowing an attacker to trigger the flaw over the network without local access.