Sanluan PublicCMS 5.202506.d contains a vulnerability in the getSignKey function within SafeConfigComponent.java where a hard-coded cryptographic key (privatefile_key) is used. This insecure practice can allow remote attackers to bypass cryptographic protections by exploiting the fixed key. The vulnerability is remotely exploitable without authentication or user interaction. The vendor was contacted but did not respond, and no patch or mitigation has been officially released. The CVSS 4.0 score is 6.9, indicating a medium severity vulnerability with partial impact on data integrity.

The use of a hard-coded cryptographic key can undermine the confidentiality and integrity of cryptographic operations within the affected CMS, potentially allowing attackers to forge signatures or decrypt sensitive data protected by the key. The vulnerability is remotely exploitable without authentication, increasing the risk of unauthorized access or manipulation. However, the impact is limited to integrity and does not affect availability or confidentiality directly according to the CVSS vector. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating risk by restricting network access to the affected service, monitoring for suspicious activity related to cryptographic operations, and preparing to apply any future patches promptly once released. Avoid relying on the affected version in sensitive environments until a fix is provided.