{"id":"CVE-2026-89260","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-89260","summary":"MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the…","details":"MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.","published":"2026-09-11T16:17:50.560","modified":"2026-09-11T16:17:50.560","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://gitee.com/moxi159753/mogu_blog_v2/releases"},{"type":"WEB","url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py"},{"type":"WEB","url":"https://github.com/moxi624/mogu_blog_v2"},{"type":"WEB","url":"https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java"},{"type":"WEB","url":"https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T16:17:50.560"}}