CVE-2026-6576
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0 in the CommandHandler function of servermanager/api/commonapi.py within the WeChat Bot Interface component. Manipulation of the Source argument leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor was contacted but did not respond.
Risk Assessment
A remote attacker could execute arbitrary commands on the host running DjangoBlog, taking control of the application and server. This may lead to data leakage and further attacks.
Recommendation
Update DjangoBlog to a version newer than 2.1.0.0 if available, or apply compensating controls (e.g., restrict access to the WeChat Bot interface). Monitor logs for command injection attempts.
Other vulnerabilities in DjangoBlog
See all- CVE-2026-6611Low
A vulnerability was found in liangliangyy DjangoBlog up to version 2.1.0.0 involving a hard-coded cryptographic key in djangoblog/settings.py within the File Upload Endpoint component. Manipulating the SECRET_KEY argument results in use of a hard-coded key. Remote exploitation is possible but rated as high complexity and difficult exploitability.
- CVE-2026-6610Low
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0 in an unknown function of the djangoblog/settings.py file, related to settings handling. Manipulation of the USER/PASSWORD arguments leads to hard-coded credentials. The attack can be launched remotely but requires a high level of complexity. The exploit has been publicly disclosed, and the vendor did not respond.
- CVE-2026-6609Medium
A flaw was found in liangliangyy DjangoBlog up to 2.1.0.0 affecting the form_valid function in oauth/views.py. Manipulating the oauthid argument causes improper authorization, and the attack may be initiated remotely. The exploit has been published.
- CVE-2026-6579Medium
A weakness was identified in liangliangyy DjangoBlog up to 2.1.0.0 affecting an unknown function in blog/views.py of the Clean Endpoint component, causing missing authentication. The attack may be initiated remotely, and a public exploit could be used. The vendor was contacted but did not respond.
- CVE-2026-6578Medium
A security flaw was discovered in DjangoBlog up to version 2.1.0.0 affecting djangoblog/settings.py, where a hard-coded SECRET_KEY is used. The attack can be launched remotely but requires high complexity. The exploit has been publicly released and the vendor did not respond.
Original NVD description (English source)
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS