This vulnerability affects the templateResult API component of Sanluan PublicCMS 5.202506.d, specifically the execute function in publiccms-core/src/main/java/com/publiccms/views/directive/tools/TemplateResultDirective.java. Improper neutralization of special elements in the template engine occurs when processing the templateContent argument, which can be manipulated remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch has been provided by the vendor, and the exploit code is publicly available.

The vulnerability allows remote attackers to manipulate template content in the CMS, which may lead to unintended template processing or injection of special elements. The CVSS score of 5.3 reflects a medium impact with potential limited confidentiality, integrity, and availability effects. There is no indication of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying temporary mitigations such as restricting access to the vulnerable API or sanitizing inputs before they reach the template engine. Monitor for updates from the vendor for an official patch.