CVE-2026-89260

MoguBlog through version 6.2 is vulnerable to XML external entity (XXE) injection (CWE-611) in its WeChat callback handler at POST /wechat/wechatCheck. An unauthenticated attacker can send an XML body containing a DOCTYPE declaration with external parameter entities; the WechatRestApi.index() method passes the raw request body to SignUtil.xmlMap(), which parses it with a dom4j SAXReader that has no DTD or external-entity restrictions. Because resolved entity content is reflected in error responses, an attacker can read arbitrary local files from the server (e.g., application configuration or credentials) and can also force the server to issue outbound HTTP requests (SSRF), potentially probing internal networks. Any MoguBlog deployment up to and including 6.2 that exposes the WeChat callback endpoint is affected. There are no reports of exploitation in the wild and no public proof-of-concept is known.

What to do: Upgrade MoguBlog to a release newer than 6.2 once a patched version is published, since no fixed version is specified in current advisories. Until then, restrict access to /wechat/wechatCheck to trusted WeChat platform source IPs or place a WAF rule in front of it that rejects XML bodies containing DOCTYPE declarations, and confirm the underlying dom4j SAXReader is configured to disallow DTDs and external entities. Administrators should also review web and proxy logs for unexpected outbound HTTP requests or error responses echoing local file contents, which would indicate probing or exploitation.