{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awersswe-mp-rss/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:werss:we-mp-rss:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111687"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["we-mp-rss (\u003c= 1.5.3)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","vulnerability","webserver"],"_cs_type":"advisory","_cs_vendors":["WeRSS"],"content_html":"\u003cp\u003eWeRSS (we-mp-rss) through version 1.5.3 is susceptible to a critical remote code execution vulnerability (CVE-2026-111687). The vulnerability resides in the public GET /rss/{feed_id} endpoint, where the application improperly validates the template parameter. An unauthenticated attacker can exploit this by supplying a crafted 'ext' value alongside a '{{=expression}}' template. By utilizing object-subclass traversal techniques, the attacker can successfully bypass the application's eval denylist to execute arbitrary OS commands. This vulnerability allows for full system compromise under the context of the service account running the WeRSS application. Given the severity of the flaw (CVSS 9.8), organizations utilizing this software should immediately restrict access to the affected endpoint or upgrade to a patched version.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution, granting attackers the ability to run OS commands with the privileges of the WeRSS service account. This could lead to full system compromise, data exfiltration, or deployment of further malicious payloads. The scope of targeting is global, affecting any instance of WeRSS version 1.5.3 or lower exposed to the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict public access to the \u003ccode\u003e/rss/\u003c/code\u003e endpoint via a Web Application Firewall (WAF) or reverse proxy configuration until the software is patched.\u003c/li\u003e\n\u003cli\u003eAudit access logs for anomalous GET requests to the \u003ccode\u003e/rss/\u003c/code\u003e URI containing the \u003ccode\u003e{{=\u003c/code\u003e string sequence.\u003c/li\u003e\n\u003cli\u003eMonitor the WeRSS service process for the execution of unexpected child processes such as \u003ccode\u003ecmd.exe\u003c/code\u003e, \u003ccode\u003e/bin/sh\u003c/code\u003e, or \u003ccode\u003ecurl\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePatch the WeRSS application as soon as an official security update from the vendor is released.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:45:17Z","date_published":"2026-10-16T18:45:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111687/","summary":"WeRSS version 1.5.3 and earlier contains a remote code execution vulnerability allowing unauthenticated attackers to bypass eval denylists via template parameters.","title":"Remote Code Execution in WeRSS via Template Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-111687/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:werss:we-Mp-Rss:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}