CVE-2026-5987

CVE-2026-5987 is a template injection vulnerability affecting Sanluan PublicCMS versions up to 6.202506.d, specifically in the FreeMarker Template Handler component's AbstractFreemarkerView.doRender function. The flaw allows improper neutralization of special elements used in template engines, enabling attackers to manipulate template processing logic. The vulnerability carries a CVSS 3.1 score of 4.7 (Medium severity) and can be exploited remotely by high-privileged attackers with low complexity. While the attack requires administrative or elevated user privileges, successful exploitation could result in limited confidentiality, integrity, and availability impacts to the affected system. Exploitation status remains low-risk at present. The vulnerability has been publicly disclosed without active exploitation in the wild, and it does not appear on the CISA Known Exploited Vulnerabilities list. However, the public disclosure means exploit proof-of-concept code may become available. The vendor has been notified but has not yet provided a response or patch, leaving affected organizations dependent on defensive measures until an official update is released.