CVE-2026-120349 dayrui CVE debrief

Who should care

Defenders responsible for XunRuiCMS deployments, particularly those using version 4.7.4 or earlier, should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and address potential remote code injection risks in the Mobile Site Directory component.

Why it matters

Defenders should prioritize verifying XunRuiCMS deployments, particularly those using version 4.7.4 or earlier, and assess exposure of the Mobile Site Directory to potential remote code injection attacks. The attack can be launched remotely, and the exploit has been released to the public. However, the vendor did not respond to early disclosure, and additional information is limited.

• Potential remote code execution requires verification
• Input validation and sanitization may be necessary
• Monitoring for suspicious activity is recommended

Technical summary

The vulnerability exists in the str_replace function of the /var/www/html/zzmob/index.php file in the Mobile Site Directory component of dayrui XunRuiCMS up to 4.7.4. The manipulation of the dirname argument leads to code injection, allowing remote attacks. The attack can be launched remotely, and the exploit has been released to the public. However, additional information is limited due to restricted source details. Defenders should prioritize verifying XunRuiCMS deployments and assessing exposure of the Mobile Site Directory.

Defensive priority

Defenders should prioritize verifying the presence of XunRuiCMS version 4.7.4 or earlier and assess exposure of the Mobile Site Directory.

Recommended defensive actions

• Verify XunRuiCMS version and assess exposure of Mobile Site Directory
• Implement input validation and sanitization for the dirname argument
• Monitor for potential remote attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor comments or additional information are not available. The source corpus provides limited information on affected scope and potential impacts. Defenders should verify XunRuiCMS deployments, particularly those using version 4.7.4 or earlier, and assess exposure of the Mobile Site Directory to potential remote code injection attacks. Evidence is limited to CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.