Is CVE-2026-89260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89260 being exploited in the wild.

How severe is CVE-2026-89260?

High severity, with a CVSS score of 7.5, published 11 September 2026.

Is there a fix for CVE-2026-89260?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89260 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-89260?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89260: MoguBlog XML external entity injection in WeChat callback handler

CVE-2026-89260 · Severity: high · CVSS 7.5 · Published 2026-09-11

MoguBlog is a blogging platform used to host and manage blog content. The WeChat callback handler accepts unauthenticated XML requests without proper security controls, allowing attackers to extract sensitive files from the server or trigger outbound network requests to internal systems. This can lead to data exfiltration and potential lateral movement within network infrastructure.

Quick answers

Is CVE-2026-89260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89260 being exploited in the wild.
How severe is CVE-2026-89260?: High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?: MoguBlog MoguBlog through 6.2.
Is there a fix for CVE-2026-89260?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89260 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-89260?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an XML external entity (XXE) injection in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests. The vulnerability requires no authentication and is remotely exploitable over the network. Resolved entities are reflected in error responses, enabling direct data exfiltration.

Affected products

MoguBlog MoguBlog through 6.2

Timeline

2026-09-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.