High severity · published Sep 11, 2026
CVE-2026-89260
MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MoguBlog · moxi624
through 6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89260
gitee.com
https://gitee.com/moxi159753/mogu_blog_v2/releases
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py
github.com
https://github.com/moxi624/mogu_blog_v2
github.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java
github.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java
www.vulncheck.com
https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint
More from MoguBlog
7.5
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
6.5
CVE-2026-109174
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
6.5
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
5.4
CVE-2026-109176
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
5.3
CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint