CVE-2026-89260CWE-611xxe

CVE-2026-89260

High · published September 11, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00734 · 53.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-09-11T20:17Z
References (6)
https://gitee.com/moxi159753/mogu_blog_v2/releases · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py · [email protected]https://github.com/moxi624/mogu_blog_v2 · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java · [email protected]https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 15:25Z
    MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
    cvelistv5