CVE-2026-109160: Open Redirect in PublicCMS

This vulnerability in PublicCMS up to version 5.202608.a involves the SafeConfigComponent.getSafeUrl function in the pay Endpoint component. An attacker can manipulate the returnUrl parameter to cause an open redirect, potentially redirecting users to malicious sites. The vulnerability is remotely exploitable without privileges or user interaction, though user interaction is required to trigger the redirect. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality or availability impact, and low integrity impact. The vendor was contacted but did not respond, and no patch or official fix is available. Public exploit details have been disclosed.

Successful exploitation allows an attacker to redirect users to arbitrary external URLs, which can facilitate phishing or social engineering attacks. There is no direct impact on confidentiality, integrity, or availability of the system itself. The vulnerability requires user interaction to trigger the redirect.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing input validation or filtering on the returnUrl parameter as a temporary mitigation to prevent open redirects. Monitor official vendor channels for updates or patches.