This vulnerability affects the FreeMarker Template Handler component of Sanluan PublicCMS, where the AbstractFreemarkerView.doRender method fails to properly neutralize special elements used in templates. This improper neutralization can be exploited remotely to manipulate template rendering, potentially leading to unintended behavior or exposure of sensitive information. The issue has been reported and publicly disclosed, but the vendor has not yet issued a response or patch. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low complexity, no user interaction, and requiring high privileges.

The vulnerability allows remote attackers with high privileges to exploit improper neutralization in the template engine, which may lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, the impact is limited due to the requirement of high privileges and the low scope change. No known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the affected functionality and limiting high privilege accounts may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.