medium4.3
CVE-2026-109177
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-di…
Impact
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
Affected products
| Product | Affected versions |
|---|---|
| MoguBlog | through 6.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_networkDisk_ownership.py
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/restapi/NetworkDiskRestApi.java#L165-L191
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/NetworkDiskServiceImpl.java#L239-L302
- https://www.vulncheck.com/advisories/mogublog-through-6.2-broken-access-control-via-networkdisk-movefile-and-edit