# CVE-2026-120349: dayrui XunRuiCMS code injection in mobile site directory

Source: https://junglewise.ai/threats/cve-2026-120349-a-security-flaw-has-been-discovered-in-dayrui-xunruicms-up-to-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120349 · Severity: high · CVSS 7.3 · Published 2026-11-02

XunRuiCMS is a content management system that allows administrators to configure mobile website directories. An attacker with backend access can inject arbitrary PHP code through the mobile site directory name parameter, leading to remote code execution as the web server user. The injected code persists as a backdoor accessible over HTTP without authentication.

Technologies: [Dayrui XunruiCMS](https://junglewise.ai/threats/technologies/dayrui-xunruicms). Vendors: [Dayrui](https://junglewise.ai/threats/vendors/dayrui).

## Quick answers

**Is CVE-2026-120349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120349 being exploited in the wild.

**How severe is CVE-2026-120349?** High severity, with a CVSS score of 7.3, published 2 November 2026.

**Which products and versions are affected?** Dayrui XunruiCMS up to 4.7.4.

**Is there a fix for CVE-2026-120349?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120349 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120349?** Check whether you run Dayrui XunruiCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw in the mobile-site configuration component where the dirname parameter is used unsanitized in both a file path and directly substituted into PHP source code via str_replace(). An authenticated backend user can inject PHP statements by closing the string literal in the generated index.php file. The malicious code executes immediately when the entry file is written to the web root, creating a persistent anonymously-accessible backdoor.

## Affected products

- dayrui XunRuiCMS up to 4.7.4

## Timeline

- 2026-11-02: disclosed
- exploited: exploit released to public

## References

- [https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md](https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md)
- [https://vuldb.com/cve/CVE-2026-120349](https://vuldb.com/cve/CVE-2026-120349)

## Related threats

- [dayrui XunRuiCMS code injection in email template rendering](https://junglewise.ai/threats/cve-2026-120348-a-vulnerability-was-identified-in-dayrui-xunruicms-up-to-4-7-4)
- [dayrui XunRuiCMS SQL injection in Member Module](https://junglewise.ai/threats/cve-2026-120347-a-vulnerability-was-determined-in-dayrui-xunruicms-up-to-4-7-4)
- [dayrui XunruiCMS SQL injection in Group Editing](https://junglewise.ai/threats/cve-2026-101018-a-vulnerability-was-determined-in-dayrui-xunruicms-up-to-4-7-2)