---
id: "CVE-2026-120349"
kind: "vulnerability"
aliases: ["CVE-2026-120349"]
title: "XunRuiCMS up to 4.7.4: unauthenticated code injection via dirname in zzmob/index.php, public PoC, no vendor fix"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "XunRuiCMS", "fixed": [], "affected": "<= 4.7.4", "ecosystem": "vendor"}]
ecosystems: []
tags: ["other", "php", "self-hosted", "xunruicms"]
not_affected_if: ["component-absent", "newer-version"]
published_at: "2026-11-02T07:18:03+00:00"
first_seen_at: "2026-11-02T07:21:57+00:00"
updated_at: "2026-11-02T07:23:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120349", "first_seen_at": "2026-11-02T07:21:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T07:23:03+00:00"}]
---

# XunRuiCMS up to 4.7.4: unauthenticated code injection via dirname in zzmob/index.php, public PoC, no vendor fix

In XunRuiCMS up to 4.7.4, the dirname argument of the Mobile Site Directory component's str_replace call in zzmob/index.php is not handled safely. A remote attacker can inject code that the server runs, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:XunRuiCMS affected <= 4.7.4 fixed ?

## How to check

Check your XunRuiCMS version (admin panel or version file): 4.7.4 and older are listed as affected, and 4.7.4 is the latest release on the vendor's site. Check whether zzmob/index.php exists in the web root; the report names /var/www/html/zzmob/index.php. Search web logs for requests to zzmob/index.php with a dirname parameter.

## Timeline

- 2026-11-02T07:21:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120349
- 2026-11-02T07:23:03+00:00 analyst — VulDB (CNA) page read: remote, no auth, PoC on GitHub (link locked), vendor did not respond; vendor bug list at xunruicms.com does not list this CVE and names 4.7.4 as latest, so no fix known. Not verified: no vendor advisory. zzmob default config unknown. Sibling CVE-2026-120348 same product.

## Documents

- [advisory] VulDB VDB-429673: XunRuiCMS up to 4.7.4 Mobile Site Directory code injection https://vuldb.com/vuln/429673
- [describes] XunRuiCMS vendor known-vulnerability list (latest 4.7.4) https://www.xunruicms.com/bug/

## From the sources

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_