What is CVE-2026-120349 in XunRuiCMS?
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4, tracked as CVE-2026-120349 con CVSS 8.4 de escalada. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory.
The manipulation of the argument dirname results in code injection. The attack can be launched remotely over the network without requiring user authentication or interaction, similar to issues found in ActivityStarter.java que permite la escalada.
Who is affected and what is the severity?
The vulnerability carries a CVSS base score of 7.3, placing it in the high severity category. The vector string is designated as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating low complexity for remote exploitation.
The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way, leaving deployments exposed.
How do I protect my installation?
Since the vendor has not released an official patch or responded to early disclosures, administrators must take manual steps to protect their web servers and web applications.
You can mitigate the risk by following these hardening steps:
- Restrict external network access to the /var/www/html/zzmob/index.php file using web server rules.
- Validate and sanitize all incoming parameters, specifically the dirname argument, before passing them to string manipulation functions.
- Monitor web server logs for suspicious requests targeting the Mobile Site Directory component.