CVE-2026-89260: MoguBlog XXE Vulnerability in WeChat Handler

CVE-2026-89260 Overview

CVE-2026-89260 is an XML External Entity (XXE) injection vulnerability in MoguBlog through version 6.2. The flaw resides in the WeChat callback handler exposed at POST /wechat/wechatCheck. The WechatRestApi.index() method forwards the raw HTTP request body to SignUtil.xmlToMap(), which parses input with an unhardened dom4j SAXReader. Because DTD processing and external entities remain enabled, unauthenticated remote attackers can submit crafted XML payloads containing DOCTYPE declarations and external parameter entities. Successful exploitation allows attackers to read arbitrary local files or force outbound HTTP requests from the server. Resolved entities are reflected back to the attacker in error responses, enabling in-band data exfiltration.

Critical Impact
Unauthenticated attackers can read arbitrary server files and pivot into internal networks via server-side request forgery through the WeChat callback endpoint.

Affected Products

MoguBlog through version 6.2
mogu_web component containing WechatRestApi
mogu_utils component containing SignUtil.xmlToMap()

Discovery Timeline

2026-09-11 - CVE-2026-89260 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89260

Vulnerability Analysis

The vulnerability [CWE-611] originates in MoguBlog's WeChat integration layer. WeChat callbacks are delivered as XML documents, and MoguBlog parses them without applying any XML parser hardening. Attackers do not need credentials, tokens, or WeChat signatures to reach the vulnerable endpoint. A single HTTP POST request containing a malicious XML document is sufficient to trigger entity resolution inside the server process. Because parser errors surface resolved entity values in HTTP responses, the endpoint operates as an in-band oracle for file contents and network probe results.

Root Cause

The SignUtil.xmlToMap() utility instantiates a dom4j SAXReader with default settings. The reader does not disable DOCTYPE declarations, external general entities, or external parameter entities. There is no allowlist on the XML input and no schema validation. Any request body reaching WechatRestApi.index() is fed directly to this parser without prior sanitization or WeChat signature verification, exposing the parser to attacker-controlled markup.

Attack Vector

An unauthenticated remote attacker sends a POST request to /wechat/wechatCheck with a Content-Type of XML and a body that defines a DOCTYPE with an external parameter entity. The entity resolves to a local file path such as file:///etc/passwd or an internal HTTP URL. When the parser dereferences the entity, the server reads the target resource and includes the retrieved content in the resulting error response. Attackers can rotate targets to enumerate files, probe internal services, or fingerprint cloud metadata endpoints.

A public proof-of-concept script is published in the GitHub Proof of Concept repository. Refer to the VulnCheck Advisory - Mogu Blog EE for the full technical write-up.

Detection Methods for CVE-2026-89260

Indicators of Compromise

Unauthenticated POST requests to /wechat/wechatCheck from unexpected source addresses or without valid WeChat signature headers.
Request bodies containing <!DOCTYPE, <!ENTITY, SYSTEM, or file://, http://, or ftp:// URIs inside XML payloads.
HTTP 4xx or 5xx responses from /wechat/wechatCheck whose bodies embed local file content or internal hostnames.
Outbound connections from the MoguBlog application server to attacker-controlled hosts immediately following calls to the callback endpoint.

Detection Strategies

Deploy web application firewall rules that inspect request bodies to /wechat/wechatCheck for DOCTYPE and ENTITY tokens.
Alert on any HTTP request to the WeChat callback path lacking the expected WeChat signature, timestamp, and nonce parameters.
Correlate inbound requests to the callback endpoint with outbound DNS or HTTP traffic originating from the application server within a short time window.

Monitoring Recommendations

Enable verbose access logging for the mogu_web service, capturing request bodies for the /wechat/* route.
Forward application and network logs to a centralized analytics platform and baseline normal outbound destinations for the MoguBlog host.
Monitor file system access on sensitive paths such as /etc/passwd, /proc/self/environ, and application configuration directories.

How to Mitigate CVE-2026-89260

Immediate Actions Required

Restrict network access to /wechat/wechatCheck so that only WeChat's published IP ranges can reach the endpoint.
Disable the WeChat integration in MoguBlog if it is not in active use.
Enforce WeChat signature validation before any XML parsing occurs in WechatRestApi.index().
Deploy a WAF signature that blocks XML payloads containing DOCTYPE or external entity declarations directed at the vulnerable path.

Patch Information

At the time of publication, no fixed release is listed in the Gitee Mogu Blog Releases or the upstream GitHub Mogu Blog Repository. Operators should track these repositories for an updated build addressing SignUtil.xmlToMap() and apply the patched version to all affected instances.

Workarounds

Modify SignUtil.xmlToMap() to configure the dom4j SAXReader with http://apache.org/xml/features/disallow-doctype-decl set to true and disable external general and parameter entities.
Introduce a pre-parsing filter that rejects any request body containing <!DOCTYPE or <!ENTITY before invoking the XML parser.
Remove the /wechat/wechatCheck route from the deployed application if WeChat callbacks are not required.

bash

# Example dom4j SAXReader hardening applied in SignUtil.xmlToMap()
SAXReader reader = new SAXReader();
reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);