CVE-2026-120348 in XunRuiCMS
Summary
by MITRE • 11/02/2026
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Dayrui XunRuiCMS versions up to 4.7.4 represents a critical security flaw within the application's email template rendering engine, specifically located in the _get_tpl_content function found in the dayrui/Fcms/Library/Notice.php file. This component is responsible for processing and rendering dynamic content for email notifications sent by the CMS platform. The core technical issue stems from insufficient input validation and sanitization mechanisms when handling user-supplied data that is passed to this template parsing routine. Because the application fails to properly escape or restrict special characters within these inputs, an attacker can inject arbitrary code into the context where the template content is evaluated. This lack of proper boundary enforcement allows malicious payloads to bypass intended execution contexts, leading directly to remote code injection capabilities.
From a technical perspective, this flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection), as it involves the unauthorized creation or modification of executable code through manipulated input data. The vulnerability is classified under ATT&CK technique T1059 Command and Scripting Interpreter because the injected payload typically executes system commands or scripting instructions within the server environment where the CMS resides. Since the affected function handles template content, which often processes variables from user interactions such as form submissions, comment sections, or profile updates, the attack surface is broad. The ability to initiate this exploit remotely means that an unauthenticated attacker can traverse network boundaries to target the vulnerable instance without requiring prior access credentials, significantly lowering the barrier for exploitation and increasing the potential impact on system integrity.
The operational impact of this vulnerability is severe, as successful exploitation grants attackers the ability to execute arbitrary commands with the privileges of the web server process. This level of control typically leads to full system compromise, allowing adversaries to exfiltrate sensitive data, install backdoors, pivot into internal networks, or deface the website. The fact that a public exploit exists further amplifies the risk, as automated scanning tools and opportunistic attackers can leverage this known method to target vulnerable instances across the internet indiscriminately. Organizations running affected versions of XunRuiCMS are at immediate risk of intrusion unless remediation is applied promptly.
Mitigation strategies must prioritize upgrading to a patched version of Dayrui XunRuiCMS that addresses the input validation flaws in the Notice.php library. In cases where an upgrade is not immediately feasible, administrators should implement strict web application firewall rules to detect and block patterns associated with code injection attempts targeting template parameters. Additionally, enforcing principle of least privilege for the web server account can limit the damage if exploitation occurs by restricting file system access and command execution capabilities. Regular security audits and penetration testing are recommended to identify similar weaknesses in other components that handle dynamic content rendering. Given the vendor's lack of response to early disclosure efforts, users must rely on community patches or alternative CMS solutions if a timely official fix is not provided.