CVE-2026-3289

Executive Summary

CVE-2026-3289 is a path traversal vulnerability in Sanluan PublicCMS version 6.202506.d. The flaw resides in the TemplateCacheComponent.java file, specifically within the saveMetadata function. An unauthenticated remote attacker can manipulate the template cache generation process to traverse directories, potentially reading or writing arbitrary files on the server. The vendor was contacted but did not respond, and no official patch is available. The exploit has been publicly released, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Java-based CMS application (PublicCMS) distributed as a standalone WAR or JAR file. Users should verify the integrity of their downloaded artifacts from the official source and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited file read access.
• Integrity Impact: Low (I:L) – Limited file write/modification.
• Availability Impact: Low (A:L) – Potential for denial of service via cache corruption.

Threat Level: Medium. The public availability of an exploit and the lack of a patch elevate the risk. However, the impact is limited to low-level confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the TemplateCacheComponent.java file, which handles the generation and caching of templates in PublicCMS. The saveMetadata function is responsible for saving metadata associated with cached templates. It fails to properly sanitize user-supplied input used to construct file paths.

Root Cause: The function uses user-controlled parameters (likely from HTTP request parameters or headers) to build a file path for storing cache metadata. Without proper validation, an attacker can inject path traversal sequences (e.g., ../) to escape the intended cache directory.

Attack Flow:

1. An attacker sends a crafted HTTP request to the PublicCMS server, targeting the template cache generation endpoint.
2. The request includes malicious parameters containing path traversal sequences (e.g., ../../etc/passwd).
3. The saveMetadata function uses these parameters to construct a file path without sanitization.
4. The function writes or reads metadata to/from the attacker-controlled path, allowing arbitrary file read or write.

Impact:

• File Read: An attacker can read sensitive files such as configuration files, database credentials, or source code.
• File Write: An attacker can overwrite critical files (e.g., configuration, templates) leading to code execution or defacement.
• Cache Poisoning: The attacker can manipulate the cache to serve malicious content to other users.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common secure coding practices.

Vulnerable Code (Conceptual):

public void saveMetadata(String userInput) {
    String filePath = "/cache/metadata/" + userInput;
    File file = new File(filePath);
    // Write metadata to file
    FileWriter writer = new FileWriter(file);
    writer.write(metadata);
    writer.close();
}

Patched Code (Conceptual):

public void saveMetadata(String userInput) {
    // Sanitize input: remove path traversal sequences
    String sanitizedInput = userInput.replaceAll("\\.\\./", "").replaceAll("\\.\\.\\\\", "");
    // Ensure the path is within the intended directory
    String basePath = "/cache/metadata/";
    String filePath = basePath + sanitizedInput;
    File file = new File(filePath);
    // Canonical path check to prevent traversal
    if (!file.getCanonicalPath().startsWith(new File(basePath).getCanonicalPath())) {
        throw new SecurityException("Invalid path");
    }
    // Write metadata to file
    FileWriter writer = new FileWriter(file);
    writer.write(metadata);
    writer.close();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of PublicCMS 6.202506.d.
• Network access to the target server.

Exploit Steps:

1. Identify the vulnerable endpoint (likely /templateCache/saveMetadata or similar).
2. Craft a request with a path traversal payload in the path parameter.
3. Example using curl:

   curl -X POST "http://target.com/templateCache/saveMetadata" \
        -d "path=../../etc/passwd&metadata=test"
   

4. Verify file read by checking the response or accessing the written file.

Proof-of-Concept (Python):

import requests

target = "http://target.com/templateCache/saveMetadata"
payload = {"path": "../../etc/passwd", "metadata": "test"}
response = requests.post(target, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for HTTP requests containing ../ or ..\\ in parameters.
• Look for unusual file access patterns in server logs (e.g., attempts to read /etc/passwd).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply input validation and sanitization as shown in the patched code.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Restrict file system permissions for the application user.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /templateCache/saveMetadata with parameters containing ../ or ..\\.
  • Outbound connections to unknown IPs after exploitation (if code execution is achieved).
• File System:
  • Unexpected files in /etc/, /var/www/, or other sensitive directories.
  • Modified cache files in /cache/metadata/ with unusual content.
• Logs:
  • Application logs showing errors related to file path resolution.
  • Web server logs with 200 responses to suspicious POST requests.

Detection Engineering

YARA Rule

rule CVE_2026_3289_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting PublicCMS saveMetadata"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-3289"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/templateCache/saveMetadata"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2026-3289 Path Traversal in PublicCMS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts against PublicCMS saveMetadata endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/templateCache/saveMetadata'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-3289 PublicCMS Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/templateCache/saveMetadata"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system: If possible, disconnect the PublicCMS instance from the internet until a patch is applied.
2. Apply input validation: Manually patch the saveMetadata function in TemplateCacheComponent.java to sanitize input and validate file paths.
3. Use a WAF: Deploy a Web Application Firewall with rules to block path traversal patterns (e.g., ../, ..\\).
4. Monitor logs: Actively monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Vendor Patch: Await an official patch from Sanluan. Since the vendor has not responded, consider switching to an alternative CMS or forking the project to apply security fixes.
• Code Review: Conduct a thorough security review of the entire codebase for similar vulnerabilities.
• Update Dependencies: Ensure all third-party libraries are up to date.

Workaround:

• Disable the template cache generation feature if not essential.
• Restrict file system permissions for the application user to prevent writes to sensitive directories.

Valters IT
Securing Digital Frontiers