Medium severity4.3NVD Advisory· Published Oct 12, 2026
CVE-2026-109177
CVE-2026-109177
Description
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=6.2
Patches
Vulnerability mechanics
References
4- github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_networkDisk_ownership.pynvd
- github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/restapi/NetworkDiskRestApi.javanvd
- github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/NetworkDiskServiceImpl.javanvd
- www.vulncheck.com/advisories/mogublog-through-6.2-broken-access-control-via-networkdisk-movefile-and-editnvd
News mentions
0No linked articles in our index yet.