CVE-2026-90568: Mogu Blog v2 XSS Vulnerability

CVE-2026-90568 Overview

CVE-2026-90568 is a cross-site scripting (XSS) vulnerability affecting moxi624 Mogu Blog v2 versions up to 5.2. The flaw resides in the BlogSortServiceImpl.addBlogSort function within mogu_web/src/main/resources/templates/info.ftl, part of the blogSort endpoint. Attackers can manipulate the sortName argument to inject arbitrary script content that executes in the browser of any user viewing the affected page. Exploitation requires low privileges and user interaction, but can be launched remotely over the network. The project maintainers were notified through an issue report but have not responded, leaving the vulnerability unpatched at disclosure.

Critical Impact
Authenticated remote attackers can inject JavaScript through the sortName parameter, enabling session theft, credential harvesting, and unauthorized actions in the context of victim users.

Affected Products

moxi624 Mogu Blog v2 (versions through 5.2)
mogu_web module — info.ftl template
blogSort endpoint using BlogSortServiceImpl.addBlogSort

Discovery Timeline

2026-09-13 - CVE-2026-90568 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90568

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) flaw classified under [CWE-79]. It occurs when the addBlogSort function in BlogSortServiceImpl accepts a sortName value from an authenticated user and passes it into the FreeMarker template info.ftl without proper output encoding. When another user renders a page that includes the stored sortName, the browser interprets injected markup as executable script.

Because the payload persists server-side and executes for any user viewing the affected view, an attacker with low-privileged access can target administrators or other users. The impact is limited to integrity of rendered content and does not directly compromise confidentiality of server data. The EPSS score is 0.311% with a 24.2 percentile ranking.

Root Cause

The root cause is missing input sanitization and output encoding in the blog sort creation workflow. User-supplied text sent to the sortName parameter reaches the FreeMarker template without HTML entity escaping. FreeMarker requires explicit escape directives or auto-escaping configuration to neutralize markup, neither of which appears to be applied on this data path.

Attack Vector

The attack requires network access to the Mogu Blog application and authenticated access sufficient to invoke the blogSort endpoint. An attacker submits a crafted sortName value containing an HTML or JavaScript payload through the sort creation request. The payload is persisted and served to subsequent users who load pages rendering the sort list. User interaction — visiting the affected page — is required to trigger execution.

Because no verified proof-of-concept code is available, refer to the Gitee Issue Discussion and the VulDB Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-90568

Indicators of Compromise

Blog sort entries containing HTML tags such as <script>, <img onerror=, or <svg onload= in the sortName field.
Unexpected outbound requests from user browsers to attacker-controlled domains after visiting pages that render blog categories.
Session cookies or authentication tokens appearing in web server referrer logs of untrusted domains.

Detection Strategies

Review database records for the blog sort table to identify stored values containing angle brackets or JavaScript event handlers.
Inspect application logs for POST requests to the blogSort endpoint that include suspicious characters in the sortName parameter.
Deploy Content Security Policy (CSP) reporting to capture script-src violations originating from the admin or sort views.

Monitoring Recommendations

Enable HTTP request logging that captures full request bodies for the blogSort endpoint to support forensic review.
Monitor administrator sessions for anomalous actions immediately following navigation to pages rendering blog sort content.
Alert on any newly created blog sort entries authored by low-privileged accounts outside of expected content workflows.

How to Mitigate CVE-2026-90568

Immediate Actions Required

Restrict access to the blogSort administrative endpoint to trusted accounts only until a patch is available.
Audit existing sort entries and remove any records containing HTML markup or scripting payloads.
Deploy a strict Content Security Policy that disallows inline scripts on pages rendering user-generated content.

Patch Information

No vendor patch is available at the time of publication. The Gitee Issue Discussion documents that the project has not responded to the report. Track the upstream repository for future releases addressing the BlogSortServiceImpl.addBlogSort code path.

Workarounds

Place a web application firewall (WAF) rule in front of the application to block requests to blogSort containing <, >, or javascript: sequences in the sortName parameter.
Apply server-side input validation that rejects sortName values containing characters outside an allowlist such as letters, digits, spaces, and hyphens.
Enable FreeMarker auto-escaping for the info.ftl template by configuring the output format to HTML, ensuring rendered variables are entity-encoded.

bash

# Example WAF rule (ModSecurity) to block XSS payloads in sortName
SecRule ARGS:sortName "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1029056801,phase:2,deny,status:403,log,\
    msg:'CVE-2026-90568 - XSS attempt in Mogu Blog sortName parameter'"