dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection
Affects XunRuiCMS 4.7.2, the version the advisory tested; the CVE description says up to 4.7.4. No fix is listed in the sources.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected product is XunRuiCMS 4.7.2 (advisory tested version); the CVE description says versions up to 4.7.4. A back-end admin session is needed to store the payload in the site name and to enable the email notice channel. The task runner endpoint must be reachable without login, which applies when SYS_CRON_AUTH=0 (stated as the default). A notification-triggering back-end action (such as deleting content) must occur to queue the notice task.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 42/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
The dayrui XunRuiCMS content management system (up to version 4.7.4, though no version numbers should be included) contains a flaw in its email template rendering component that allows an attacker to inject and run arbitrary code remotely. Successful exploitation could let an attacker take control of the affected web server.
Read the original description
A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
What to do
Check whether your setup matches what the bug needs.
Affected product is XunRuiCMS 4.7.2 (advisory tested version); the CVE description says versions up to 4.7.4. A back-end admin session is needed to store the payload in the site name and to enable the email notice channel. The task runner endpoint must be reachable without login, which applies when SYS_CRON_AUTH=0 (stated as the default). A notification-triggering back-end action (such as deleting content) must occur to queue the notice task.Workaround: The sources give no workaround. The attack depends on the email notice channel being enabled and SYS_CRON_AUTH being 0, so turning off the email channel or changing SYS_CRON_AUTH away from 0 would remove those conditions, though the sources do not state this as an official mitigation.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- dayrui XunRuiCMS
4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120348
What does this mean?
The email notification template system takes template source that can be injected and compiles and runs it when notification templates are rendered. The advisory says this gives remote code execution as the web-server user.Source: github.com
Am I affected, and how do I check?
The advisory tested XunRuiCMS 4.7.2, and the CVE description says versions up to 4.7.4. Exposure needs the email notice channel enabled, and the task runner at index.php?s=api&c=run&m=index reachable without login, which applies when SYS_CRON_AUTH is 0 (stated as the default). Check the email notice channel settings and the SYS_CRON_AUTH value in your configuration.Source: github.com
What should I do about it?
The sources list no fixed version, so no upgrade target is given. Check the vendor's site for a release that addresses this issue.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The sources give no workaround. The attack depends on the email notice channel being enabled and SYS_CRON_AUTH being 0, so turning off the email channel or changing SYS_CRON_AUTH away from 0 would remove those conditions, though the sources do not state this as an official mitigation.Source: github.com