CVE-2025-69437

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS

High · published February 27, 2026

CVSS v3.1
8.7
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can be triggered, resulting in issues such as credential theft, arbitrary API execution, and other security concerns. This vulnerability affects all file upload endpoint, including /cmsTemplate/save, /file/doUpload, /cmsTemplate/doUpload, /file/doBatchUpload, /cmsWebFile/doUpload, etc.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Published
2026-02-27T00:00Z
EPSS history
Timeline
  • 27 FEB 00:00Z
    PublicCMS v5.202506.d and earlier is vulnerable to stored XSS
    cvelistv5