CVE-2026-109160
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-601
Impact
Remote attackers can redirect users to arbitrary external phishing sites if a user clicks a manipulated link. No authentication is required.
Root cause
Improper input validation in SafeConfigComponent.getSafeUrl allows untrusted values in the returnUrl parameter to dictate redirection destinations.
Affected systems
PublicCMS up to and including 5.202608.a
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor fix is currently available; block or sanitize untrusted external URLs in the returnUrl parameter at your reverse proxy or WAF for the pay endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.