CVE-2026-89260
HighCVSS 7.5Summary
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
Risk Assessment
An attacker could read arbitrary local files on the server and trigger outbound HTTP requests, potentially leading to data disclosure and use of the server as a proxy in SSRF attacks.
Recommendation
Update MoguBlog to a version later than 6.2, where the XML parser has been hardened by disabling DTD and external entities.
Other vulnerabilities in MoguBlog
See all- CVE-2026-89265Medium
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
- CVE-2026-89264Medium
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
- CVE-2026-89263Medium
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint. An unauthenticated attacker can disable email notifications for arbitrary users by modifying the startEmailNotification flag in the Redis cache.
- CVE-2026-89262High
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
- CVE-2026-89261Medium
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication. A remote attacker can delete, recreate, or alter the blog search index, causing search functionality to return incorrect or no results.
Original NVD description (English source)
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.