The PublicCMS getXml method is vulnerable to a Server-Side Request Forgery (SSRF) that leads to information disclosure. This flaw is due to missing authorization controls, permitting unauthenticated remote attackers to access sensitive data within the application context. The vulnerability was reported to the vendor in April 2024, but as of the coordinated public disclosure in April 2026, no patch or official remediation has been announced. The vulnerability carries a CVSS score of 8.2 (high severity) assigned by the Zero Day Initiative, reflecting its potential impact on confidentiality. No evidence of exploitation in the wild has been documented.

Successful exploitation allows unauthenticated remote attackers to disclose sensitive information from affected PublicCMS installations. This compromises confidentiality but does not impact integrity or availability. The vulnerability could expose internal data accessible by the application, potentially aiding further attacks or information gathering.

No official patch or fix is currently available from the vendor. The advisory recommends restricting interaction with the affected PublicCMS product to mitigate risk. Organizations should limit exposure by controlling access to the application and monitoring for unauthorized use. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.