A vulnerability was found in Sanluan PublicCMS 5.202506.d and classified as critical . The affected element is the function getSignKey of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java . The manipulation of the argument privatefile_key results in use of hard-coded cryptographic key . This vulnerability is identified as CVE-2026-8739 . The attack can be executed remotely. Additionally, an exploit exists. The vendor was contacted early about thi