CVE-2026-94102: WuzhiCMS Open Redirect Vulnerability

CVE-2026-94102 Overview

CVE-2026-94102 is an open redirect vulnerability [CWE-601] in WuzhiCMS versions up to 4.1.0. The flaw resides in the Login component reachable via /index.php?m=member&v=Login. Attackers manipulate the forward argument to redirect authenticated users to arbitrary external destinations. The only sanitization in place is remove_xss(), a keyword scrubber that does not validate URL destinations. The vendor was contacted about the issue and did not respond. A public exploit has been disclosed.

Critical Impact
Attackers can craft URLs on the trusted WuzhiCMS domain that redirect victims to phishing or malware distribution sites, enabling credential theft and social-engineering campaigns.

Affected Products

WuzhiCMS versions up to and including 4.1.0
The /index.php?m=member&v=Login Login endpoint
Deployments relying on remove_xss() for forward parameter sanitization

Discovery Timeline

2026-09-21 - CVE-2026-94102 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94102

Vulnerability Analysis

The vulnerability is a classic URL Redirection to Untrusted Site issue [CWE-601]. WuzhiCMS accepts a user-controlled forward parameter on the member login endpoint and uses it as the post-login redirect target. The application performs no destination validation, no allowlist check, and no same-origin comparison before issuing the redirect.

The remove_xss() routine, WuzhiCMS's general-purpose XSS scrubber, is the only defensive control applied to the parameter. That function strips script-related keywords and HTML entities. It does not parse the value as a URL and does not reject absolute external hostnames. As a result, values such as https://attacker.example/ pass through unchanged and are honored by the redirect logic.

Because the initial URL originates from the legitimate WuzhiCMS domain, users and email security gateways are more likely to trust the link. This trust transfer is the core impact vector for open-redirect abuse.

Root Cause

The root cause is missing output validation on a trusted-to-untrusted boundary. The Login controller treats the forward parameter as a safe navigation target after XSS filtering. XSS sanitization and URL validation address different threat classes, and substituting one for the other leaves the redirect sink unprotected.

Attack Vector

Exploitation requires no authentication and is initiated remotely over the network. An attacker crafts a URL of the form /index.php?m=member&v=Login&forward=https://attacker.example/phish. The attacker distributes the link through email, chat, or a compromised page. When the victim interacts with the link and completes or bypasses the login flow, the application redirects the browser to the attacker-controlled destination. User interaction is required, which is reflected in the scoring.

// No verified proof-of-concept code is reproduced here.
// See the GitHub advisory VULN-021 referenced below for the disclosed request pattern.

Detection Methods for CVE-2026-94102

Indicators of Compromise

HTTP requests to /index.php?m=member&v=Login containing a forward parameter with an absolute URL, scheme prefix (http://, https://, //), or encoded variants (%2f%2f, %3a%2f%2f)
Referer chains where users arrive at external phishing domains from a WuzhiCMS Login URL
Spikes in outbound clicks to newly registered domains following distribution of WuzhiCMS-hosted links

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the forward parameter on the member Login route and blocks values that are not relative paths under the site root
Add server access-log alerting for forward values whose host component does not match the application's canonical hostname
Correlate proxy logs with email gateway telemetry to surface phishing lures that pivot through the WuzhiCMS domain

Monitoring Recommendations

Log the full request URI, Referer, and post-response Location header for the Login endpoint
Track HTTP 3xx responses issued by /index.php?m=member&v=Login with off-domain Location values
Review threat-intelligence feeds for domains observed in forward parameter abuse tied to this advisory

How to Mitigate CVE-2026-94102

Immediate Actions Required

Restrict the forward parameter at a reverse proxy or WAF to relative paths only until an upstream fix is available
Audit web server logs for prior abuse of the Login endpoint's forward parameter and notify affected users
Educate users to inspect the final destination after clicking WuzhiCMS login links

Patch Information

No vendor patch has been published. According to the disclosure, the WuzhiCMS maintainers did not respond to the researcher's contact attempts. Operators should track the GitHub Wuzhicms Advisory VULN-021 and the VulDB CVE-2026-94102 entry for future updates.

Workarounds

Replace remove_xss() on the forward parameter with strict URL validation that rejects absolute URLs, protocol-relative URLs (//host), and backslash variants
Enforce an allowlist of internal redirect targets, or ignore the parameter and always redirect to a fixed post-login landing page
Add a confirmation interstitial that displays the outbound domain before performing any off-site redirect

bash

# Example nginx guard: block absolute or protocol-relative forward values on the Login route
location = /index.php {
    if ($arg_m = "member") {
        set $wuzhi_login "1";
    }
    if ($arg_v = "Login") {
        set $wuzhi_login "${wuzhi_login}1";
    }
    if ($wuzhi_login = "11") {
        if ($arg_forward ~* "^(https?:|//|\\\\|%2f%2f|%5c%5c)") {
            return 400;
        }
    }
    # ...pass to PHP-FPM as normal
}