XXE in Moxi624 Mogublog
CVE-2026-89260
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (54.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
Weakness classification (CWE)
References
- C10 - POST /wechat/wechatCheck unauthenticated XXE proof of concept (exploit)
- SignUtil.xmlToMap builds an unhardened dom4j SAXReader (technical-description)
- WechatRestApi POST /wechatCheck parses the body without verifying the signature (technical-description)
- MoguBlog releases (release-notes)
- Product (product)
- VulnCheck Advisory: MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint (third-party-advisory)
Frequently asked questions
- What is CVE-2026-89260?
- CVE-2026-89260 is a high-severity vulnerability in Moxi624 Mogublog, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2026-09-11.
- How severe is CVE-2026-89260?
- High severity. CVSS v3 base score is 7.5 out of 10.