CVE-2026-89260: MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
MoguBlog deployments through version 6.2 are exposed if the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck is reachable by an attacker.
What does an attacker need to exploit this issue?
No authentication, privileges, or user interaction are required. An attacker only needs to send a crafted XML request containing a DOCTYPE declaration with external parameter entities to the callback endpoint.
What can exploitation allow?
An attacker can read arbitrary local files or cause the server to make outbound HTTP requests. Resolved entity contents may be reflected in error responses.
How can I determine whether an instance is vulnerable?
Review the handler for POST /wechat/wechatCheck and confirm whether WechatRestApi.index() passes the raw request body to SignUtil.xmlToMap(). The affected parsing path uses dom4j SAXReader without restrictions on DTDs or external entities.