VulnerabilityPublished 21 Apr 2026

ZDI-26-295: (0Day) PublicCMS getXml Server-Side Request Forgery Information Disclosure Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 26 May 2026, 20:33 UTC

remote

What to do

AI-suggested

The advisory recommends restricting interaction with the affected PublicCMS product to mitigate risk. Organizations should limit exposure by controlling access to the application and monitoring for unauthorized use.

Description

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PublicCMS. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2.

Impact

Successful exploitation allows unauthenticated remote attackers to disclose sensitive information from affected PublicCMS installations. This compromises confidentiality but does not impact integrity or availability. The vulnerability could expose internal data accessible by the application, potentially aiding further attacks or information gathering.

Summary

The PublicCMS getXml method is vulnerable to a Server-Side Request Forgery (SSRF) that leads to information disclosure. This flaw is due to missing authorization controls, permitting unauthenticated remote attackers to access sensitive data within the application context. The vulnerability carries a CVSS score of 8.2 (high severity) assigned by the Zero Day Initiative, reflecting its potential impact on confidentiality. No evidence of exploitation in the wild has been documented.

References

zerodayinitiative.com/advisories/ZDI-26-295/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 26 May 2026, 20:06 UTC

References

Community reviews

Related threats