CVE-2026-89260

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

• CWE-611

• https://gitee.com/moxi159753/mogu_blog_v2/releases
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py
• https://github.com/moxi624/mogu_blog_v2
• https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java
• https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java
• https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89255AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89256AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89257AVideo through 29.0 contains an insecure direct object refer…5.4
• CVE-2026-89258Hugo is a static site generator. In versions after v0.123.0 …6.3
• CVE-2026-89259Hugo is a static site generator. From v0.161.0, Hugo execute…9.8
• CVE-2026-8926When asking curl to use a `.netrc` file to find credentials …9.1
• CVE-2026-89261MoguBlog through 6.2 exposes Elasticsearch index management …6.5
• CVE-2026-89262MoguBlog through 6.2 contains an authorization bypass vulner…7.5
• CVE-2026-89263MoguBlog through 6.2 fails to authenticate requests to the /…5.3
• CVE-2026-89264MoguBlog through 6.2 fails to validate the comment author id…4.3
• CVE-2026-89265MoguBlog through 6.2 contains an authorization bypass vulner…4.3
• CVE-2026-89266stb_vorbis through 1.22 contains a heap buffer overflow in s…8.2