CVE-2026-109176
Received Received - Intake

Insecure Direct Object Reference in MoguBlog Allows Admin File Deletion

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109176
EUVD
EUVD-2026-97380

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moxi624 MoguBlog 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MoguBlog through version 6.2 has an insecure direct object reference vulnerability. Authenticated administrators can delete files belonging to other administrators by sending a POST request to /networkDisk/deleteFile or batchDeleteFile. The application fails to verify if the file or folder uid belongs to the requesting admin, allowing unauthorized file deletion from local storage, Qiniu, or MinIO.

Detection Guidance

Check for unauthorized file deletions in logs, especially POST requests to /networkDisk/deleteFile or batchDeleteFile. Monitor admin accounts for unusual activity targeting other admins' files.

Impact Analysis

If you are an administrator using MoguBlog 6.2 or earlier, an attacker with admin access could delete your files or those of other admins. This could lead to data loss, disruption of services, or unauthorized modification of stored content.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized data deletion or modification, potentially violating integrity and availability requirements in GDPR and HIPAA. Loss of critical data may lead to non-compliance with retention and protection mandates.

Mitigation Strategies

Update MoguBlog to the latest version. Restrict admin privileges to prevent unauthorized access. Implement input validation to ensure file deletion requests match the admin's uid.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart