CVE-2026-111687: WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feedid} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any WeRSS deployment running version 1.5.3 or earlier that exposes the public GET /rss/{feed_id} endpoint is exposed. Exploitation does not require authentication or user interaction.
What does an attacker need to exploit it?
An attacker needs network access to the /rss/{feed_id} endpoint and a valid feed ID to target. They can provide a non-built-in ext value and a crafted {{=expression}} template parameter to bypass the eval denylist.
What level of access could exploitation provide?
Successful exploitation allows OS command execution as the account running the WeRSS service. This can affect confidentiality, integrity, and availability of the host or resources accessible to that service account.
How can I determine whether my deployment is affected?
Check whether the installed WeRSS (we-mp-rss) version is 1.5.3 or earlier and whether GET /rss/{feed_id} is reachable by untrusted network clients. Deployments that accept the template parameter on this public endpoint should be treated as vulnerable.