CVE-2026-8738: Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error

Published May 17, 2026

Updated

A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Sanluan PublicCMS=5.202506.d

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove publiccms-trade from your environment.
Uninstall or disable the Trade Payment Flow component (publiccms-trade) that contains TradeOrderController.pay / TradePaymentController.pay / AccountGatewayComponent.pay until a vendor fix is available.
Compensating control
Restrict access to payment-related endpoints and the affected controller paths (TradeOrderController.pay, TradePaymentController.pay, AccountGatewayComponent.pay) using network controls (WAF, firewall rules, ACLs) and rate-limiting to block or mitigate remote exploitation.
Operational
Audit application and access logs for calls to TradeOrderController.pay, TradePaymentController.pay, and AccountGatewayComponent.pay; investigate and perform incident response for any suspicious activity. Monitor the vendor for an official patch and apply updates when available.

Event History

May 17, 2026

CVE Published

via MITRE·07:30 AM

Data Sourced

via MITRE·07:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeakness

Jun 29, 58424

Event

via FIRST·06:54 PM

Frequently Asked Questions

What is the severity of CVE-2026-8738?

The severity of CVE-2026-8738 has been assessed as critical due to the potential for unauthorized payment processing.

How do I fix CVE-2026-8738?

To mitigate CVE-2026-8738, update Sanluan PublicCMS to version 5.202507 or later where the vulnerability has been patched.

What component is vulnerable in CVE-2026-8738?

CVE-2026-8738 affects the TradeOrderController.pay and AccountGatewayComponent.pay functions within the Sanluan PublicCMS.

What versions are affected by CVE-2026-8738?

CVE-2026-8738 specifically impacts Sanluan PublicCMS versions 5.202506.d.

Is there a workaround for CVE-2026-8738?

Currently, there is no officially recommended workaround for CVE-2026-8738, and upgrading is the best course of action.