CVE-2026-109160: PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker needs to cause a user to interact with a crafted pay endpoint request containing a manipulated returnUrl parameter. The attack can be initiated remotely and requires user interaction.
What is the likely impact of successful exploitation?
The issue allows an open redirect, meaning a user may be sent to an attacker-controlled destination after following a crafted link or request. The supplied severity vector indicates integrity impact but no stated confidentiality or availability impact.
Which deployments may be affected?
PublicCMS versions up to 5.202608.a are identified as affected. The issue is in SafeConfigComponent.getSafeUrl used by the pay endpoint.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Is a vendor fix or response identified?
No vendor response or remediation is provided. If patching is not available, review and restrict accepted returnUrl values for the pay endpoint, such as allowing only approved local paths or trusted destinations.