CVE-2026-120349 Details
Description
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A code injection vulnerability allowing remote code execution has been identified in Dayrui XunRuiCMS versions through 4.7.4. The issue arises in the Mobile Site Directory component, specifically within the str_replace function of index.php. The vulnerability is triggered by manipulating the dirname argument, which results in unauthorized code execution on the server.
To address this vulnerability, XunRuiCMS should implement strict validation of the dirname input, ensuring it only contains allowed characters and rejecting any path traversal sequences or control characters. The entry files should be generated using a method that properly escapes data, and the write target should be restricted to a predefined directory within the web root. Additionally, the application should monitor for newly created PHP files in the web root.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-120349 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1016299 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429673 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429673/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dayrui XunRuiCMS | <= 4.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |