Stored XSS Vulnerability in PublicCMS by Sanluan
CVE-2025-69437

8.7HIGH

Key Information:

Vendor

Sanluan

Status
PublicCMS
Vendor
CVE Published:
27 February 2026

What is CVE-2025-69437?

PublicCMS versions up to v5.202506.d are susceptible to a stored cross-site scripting (XSS) vulnerability. This issue allows an attacker to upload PDF files containing malicious JavaScript payloads, which can bypass security checks in the back-end processes. When a user opens a problematic PDF, the embedded script may execute, resulting in potential security implications, such as credential theft and unauthorized API access. All file upload endpoints, including /cmsTemplate/save and /file/doUpload, are affected, heightening the importance of securing file upload functionalities.

References

https://github.com/sanluan/PublicCMS/issues/103

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.