{"id":"CVE-2026-120349","kind":"vulnerability","aliases":["CVE-2026-120349"],"related":[],"title":"XunRuiCMS up to 4.7.4: unauthenticated code injection via dirname in zzmob/index.php, public PoC, no vendor fix","description":"A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"In XunRuiCMS up to 4.7.4, the dirname argument of the Mobile Site Directory component's str_replace call in zzmob/index.php is not handled safely. A remote attacker can inject code that the server runs, and a public exploit has been released.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"XunRuiCMS","fixed":[],"affected":"<= 4.7.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["other","php","self-hosted","xunruicms"],"not_affected_if":["component-absent","newer-version"],"how_to_check":"Check your XunRuiCMS version (admin panel or version file): 4.7.4 and older are listed as affected, and 4.7.4 is the latest release on the vendor's site. Check whether zzmob/index.php exists in the web root; the report names /var/www/html/zzmob/index.php. Search web logs for requests to zzmob/index.php with a dirname parameter.","fix":null,"status":"open","published_at":"2026-11-02T07:18:03+00:00","first_seen_at":"2026-11-02T07:21:57+00:00","triaged_at":"2026-11-02T07:22:22+00:00","updated_at":"2026-11-02T07:23:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T07:22:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"XunRuiCMS: mobile site directory flaw lets remote attackers inject code","impact":"high","summary":"In XunRuiCMS up to 4.7.4, the dirname argument of the Mobile Site Directory component's str_replace call in zzmob/index.php is not handled safely. A remote attacker can inject code that the server runs, and a public exploit has been released.","audience":"businesses","category":"other","nicknames":[],"who_cares":["xunruicms","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Code runs on the web server via injected input","analyst_note":"Confirm the default configuration of zzmob and whether any vendor fix or newer version exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120349.","how_to_check":"- Check whether the installed XunRuiCMS version is `4.7.4` or older.\n- Look for the zzmob/index.php file in the web root and confirm whether the Mobile Site Directory component is present.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["newer-version","component-absent"],"who_is_affected":"Sites running XunRuiCMS up to version 4.7.4 that have the Mobile Site Directory component at zzmob/index.php are exposed to remote requests. The sources do not say whether the component is enabled by default. The vendor did not respond to early disclosure, and no fixed version is named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4167,"output_tokens":574,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the default configuration of zzmob and whether any vendor fix or newer version exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120349.","search":"'-120349':19A,22A '-2026':18A,21A '/var/www/html/zzmob/index.php':95C '4.7.4':4A,34B,82C 'affect':83C 'argument':37B,106C 'attack':56B,113C,131C 'call':47B 'code':6A,59B,110C 'compon':43B,98C 'contact':135C 'cve':17A,20A 'dayrui':78C 'directori':42B,101C 'dirnam':9A,36B,107C 'disclosur':139C 'discov':76C 'earli':136C 'exploit':67B,119C 'file':94C 'fix':16A 'flaw':73C 'function':89C 'handl':52B 'host':28B 'inject':7A,58B,111C 'issu':86C 'launch':116C 'manipul':103C 'may':127C 'mobil':40B,99C 'php':25B 'poc':13A 'public':12A,66B,125C 'releas':70B,122C 'remot':55B,117C 'replac':46B,91C 'respond':143C 'result':108C 'run':63B 'safe':53B 'secur':72C 'self':27B 'self-host':26B 'server':62B 'site':41B,100C 'str':45B,90C 'unauthent':5A 'use':129C 'vendor':15A,133C 'via':8A 'way':146C 'xunruicm':1A,29B,31B,79C 'xunruicms':23A 'zzmob/index.php':11A,49B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted sites running XunRuiCMS up to 4.7.4 (VulDB lists 4.7.0 to 4.7.4) that have the Mobile Site Directory file zzmob/index.php. VulDB says no authentication is needed and the attack is remote; a public proof of concept exists. Sites without that file, or on managed hosting where it is not deployed, can skip it. Whether the component is on by default is not stated in any source.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["xunruicms"],"ptokens":["xunruicms"],"labels":["high","other","php","selfhosted","xunruicms"],"first_public_at":"2026-11-02T07:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120349","severity":null,"published_at":"2026-11-02T07:18:03+00:00","modified_at":"2026-11-02T07:18:03+00:00","first_seen_at":"2026-11-02T07:21:57+00:00","fetched_at":"2026-11-02T07:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120349:1356","url":null,"severity":null,"published_at":"2026-11-02T07:23:03+00:00","modified_at":"2026-11-02T07:23:03+00:00","first_seen_at":"2026-11-02T07:23:03+00:00","fetched_at":"2026-11-02T07:23:03+00:00","note":"VulDB (CNA) page read: remote, no auth, PoC on GitHub (link locked), vendor did not respond; vendor bug list at xunruicms.com does not list this CVE and names 4.7.4 as latest, so no fix known. Not verified: no vendor advisory. zzmob default config unknown. Sibling CVE-2026-120348 same product."}],"documents":[{"id":50796,"url":"https://vuldb.com/vuln/429673","title":"VulDB VDB-429673: XunRuiCMS up to 4.7.4 Mobile Site Directory code injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":50605,"url":"https://www.xunruicms.com/bug/","title":"XunRuiCMS vendor known-vulnerability list (latest 4.7.4)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}