---
id: "CVE-2026-120348"
kind: "vulnerability"
aliases: ["CVE-2026-120348"]
title: "XunRuiCMS: email template rendering lets remote attackers inject code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "xunruicms", "fixed": [], "affected": ">= 4.7.0, <= 4.7.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["other", "php", "self-hosted", "xunruicms"]
not_affected_if: ["not-xunruicms", "version-above-4.7.4"]
published_at: "2026-11-02T06:17:43+00:00"
first_seen_at: "2026-11-02T06:21:54+00:00"
updated_at: "2026-11-02T06:25:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120348", "first_seen_at": "2026-11-02T06:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T06:25:39+00:00"}]
---

# XunRuiCMS: email template rendering lets remote attackers inject code

XunRuiCMS 4.7.0 to 4.7.4 has a code injection flaw in _get_tpl_content in dayrui/Fcms/Library/Notice.php (email template rendering). VulDB says it can be triggered remotely without authentication and a proof of concept is public. The vendor did not respond to the researcher, and 4.7.4 (the vendor's latest release) is affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:xunruicms affected >= 4.7.0, <= 4.7.4 fixed ?

## How to check

- Find the XunRuiCMS version in the admin panel or in the project's version file. 4.7.0 to 4.7.4 are listed as affected by VulDB.
- Check whether dayrui/Fcms/Library/Notice.php exists and contains _get_tpl_content.
- Check web server logs for unusual requests that reach email or notice template functions.
- Also check older 4.x releases: VulDB lists only 4.7.0 to 4.7.4, but the submission was tested on 4.7.2.

## Timeline

- 2026-11-02T06:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120348
- 2026-11-02T06:25:39+00:00 analyst — VulDB (secondary; links a GitHub advisory/PoC I could not open) says remote, no auth needed, PoC public, vendor silent. Vendor bug list (xunruicms.com/bug) does not list this CVE and names 4.7.4 as latest, which is affected, so no fixed version. No exploitation in the wild seen. Nothing verified: no vendor advisory exists.

## Documents

- [advisory] VulDB VDB-429672: XunRuiCMS up to 4.7.4 Notice.php code injection https://vuldb.com/vuln/429672
- [describes] XunRuiCMS vendor known-vulnerability list (latest 4.7.4) https://www.xunruicms.com/bug/
- [mentions] NVD CVE-2026-120348 https://nvd.nist.gov/vuln/detail/CVE-2026-120348

## From the sources

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_