Sanluan PublicCMS 5.202506.d contains a vulnerability in the getSignKey function located in publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java. The issue arises from the use of a hard-coded cryptographic key (privatefile_key), which can be manipulated remotely. This weakens the cryptographic security of the application, potentially allowing attackers to bypass protections relying on this key. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P). The vendor has not provided any patch or mitigation guidance, and the exploit is publicly available.

The use of a hard-coded cryptographic key can allow attackers to compromise the confidentiality or integrity of data protected by this key. Since the vulnerability is remotely exploitable without privileges or user interaction, attackers could potentially perform unauthorized cryptographic operations or bypass security controls relying on the key. However, the impact is limited to the cryptographic component and does not directly indicate system-wide compromise. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's channels for updates. In the meantime, consider mitigating risk by restricting network access to the affected service, applying compensating controls to protect sensitive data, or replacing the affected component if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.