CVE-2026-109175
Received Received - Intake

Insecure Direct Object Reference in MoguBlog Exposes Admin Files

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109175
EUVD
EUVD-2026-97379

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moxi624 MoguBlog 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MoguBlog through version 6.2 has an insecure direct object reference vulnerability. Authenticated administrators can exploit this to list other administrators' network-disk files by sending a POST request to /networkDisk/getFileList. The endpoint does not filter files by admin_uid, allowing attackers to retrieve file names and download URLs of other administrators.

Detection Guidance

To detect this vulnerability, monitor POST requests to /networkDisk/getFileList endpoint. Check if the response includes file names or download URLs of other administrators without proper admin_uid filtering. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP POST requests targeting this path.

Impact Analysis

If you are an administrator using MoguBlog, attackers could access your network-disk files without proper authorization. This may lead to unauthorized data exposure, potential data leaks, or misuse of sensitive files stored in the network disk.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to sensitive data. It may result in data breaches, leading to legal penalties, reputational damage, and loss of trust due to inadequate access controls.

Mitigation Strategies

Immediately update MoguBlog to the latest version that patches this vulnerability. If an update is unavailable, restrict access to the /networkDisk/getFileList endpoint via firewall rules or web application firewall (WAF) configurations. Ensure all administrator accounts use strong, unique passwords and enable multi-factor authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart