CVE-2026-89260
Received Received - Intake

XML External Entity Injection in MoguBlog

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89260
EUVD
EUVD-2026-76133

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mogublog mogublog to 6.2 (inc)
moxi624 mogu_blog 6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XML External Entity (XXE) injection flaw in MoguBlog through version 6.2. It affects the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck. The issue occurs because the SignUtil.xmlToMap() method uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests. Resolved entities may be reflected in error responses.

Detection Guidance

To detect this vulnerability, check if your MoguBlog instance is running version 6.2 or earlier. Test the POST /wechat/wechatCheck endpoint by sending a crafted XML payload with a DOCTYPE declaration to trigger XXE. Example curl command: curl -X POST http://<target>/wechat/wechatCheck -d '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>'

Verify if the server responds with file contents or errors reflecting the XXE payload. Also check logs for unusual outbound HTTP requests from the server.

Impact Analysis

Unauthenticated remote attackers can exploit this to read sensitive files on the server, perform outbound HTTP requests for data exfiltration, or trigger denial-of-service via entity expansion (XXE bomb). It may also allow session token forging by manipulating the Ticket parameter in XML payloads, leading to unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized file access or data exfiltration may result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade MoguBlog to a version that hardens the dom4j SAXReader by disabling DTD and external entity processing. Apply input validation to the raw request body in WechatRestApi.index().

Restrict access to /wechat/wechatCheck via WebSecurityConfig to authenticated users only. Disable the POST endpoint if not required for WeChat integration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89260. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart