EUVD-2026-76133
GHSA-92wh-xp96-v6mj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint, no complexity; impact is read-only file exfiltration and SSRF with no write or availability impact established.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
AnalysisAI
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary files from the server filesystem and trigger outbound SSRF requests via the public WeChat callback endpoint. The WechatRestApi.index() method passes raw POST body XML directly to SignUtil.xmlToMap(), which instantiates a dom4j SAXReader without any DTD or external-entity restrictions, enabling full XXE exploitation with entity resolution reflected in error responses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the /wechat/wechatCheck endpoint is a public WeChat platform callback handler that accepts unauthenticated POST requests by design. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 base score accurately reflects the technical profile - network-accessible, zero authentication required, low complexity, and high confidentiality impact through arbitrary file reads. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been confirmed at time of analysis; monitor the project repository at https://github.com/moxi624/mogu_blog_v2 and the VulnCheck advisory at https://www.vulncheck.com/advisories/mogublog-through-6.2-xml-external-entity-injection-in-the-unauthenticated-wechat-callback-endpoint for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all systems running MoguBlog ≤6.2, review WeChat endpoint access logs for suspicious XML payloads or error-response anomalies that may indicate exploitation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any com
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through versi
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. Rated medium sev
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remot
Server-side request forgery in Mogu Blog v2 up to version 5.2 allows remote, unauthenticated attackers to force the serv
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-cate
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arb
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated rem
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories v
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitra
Share
External POC / Exploit Code
Leaving vuln.today