---
id: CVE-2026-89260
title: >-
  MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated
  WeChat Callback Endpoint
summary: >-
  MoguBlog through 6.2 contains an XML external entity injection vulnerability
  in the WeChat callback handler at POST /wechat/wechatCheck. The
  WechatRestApi.index() method passes the raw request body to
  SignUtil.xmlToMap(), which uses an u…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-611
vendor: moxi624
product: MoguBlog
affected:
  - MoguBlog <= 6.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T16:49:37.906838Z'
exploitAvailable: true
published: '2026-09-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:21:36.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89260'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C10_wechat_callback_unsigned.py
    label: C10 - POST /wechat/wechatCheck unauthenticated XXE proof of concept
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_utils/src/main/java/com/moxi/mogublog/utils/wechat/SignUtil.java
    label: SignUtil.xmlToMap builds an unhardened dom4j SAXReader
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/WechatRestApi.java
    label: >-
      WechatRestApi POST /wechatCheck parses the body without verifying the
      signature
  - url: 'https://gitee.com/moxi159753/mogu_blog_v2/releases'
    label: MoguBlog releases
  - url: 'https://github.com/moxi624/mogu_blog_v2'
    label: Product
  - url: >-
      https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint
    label: >-
      VulnCheck Advisory: MoguBlog through 6.2 XML External Entity Injection in
      the Unauthenticated WeChat Callback Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00425
epssPercentile: 0.36421
ingestedAt: '2026-09-14T11:11:19.882Z'
---

## Overview

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

## Affected

- `MoguBlog <= 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.