Beveiligingsadvies

CVE-2026-89260

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-11 15:25:15

Laatst bijgewerkt 2026-09-11 20:29:35

Toegewezen door VulnCheck

CVSS-score 8.7

Status PUBLISHED

Beschrijving

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

← Alle CVE's bekijken Bekijk op cve.org ↗