CVE-2026-89260 PUBLISHED

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

• Mingsheng Lin reporter

• C10 - POST /wechat/wechatCheck unauthenticated XXE proof of concept
• SignUtil.xmlToMap builds an unhardened dom4j SAXReader
• WechatRestApi POST /wechatCheck parses the body without verifying the signature
• MoguBlog releases
• Product
• VulnCheck Advisory: MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

• Improper Restriction of XML External Entity Reference CWE