CVE-2026-109175: MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

Q: What access does an attacker need to exploit this issue?

The attacker needs an authenticated administrator account and access to the POST /networkDisk/getFileList endpoint. No user interaction is required.

Q: What information can be exposed?

An attacker can enumerate other administrators' network-disk files because the endpoint does not restrict results by admin_uid. The exposed results include file names and download URLs.

Published Oct 12, 2026

Updated

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by adminuid, to obtain other administrators' file names and download URLs.

Affected Software

1 affected component

MoguBlog MoguBlog<=6.2

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs an authenticated administrator account and access to the POST /networkDisk/getFileList endpoint. No user interaction is required.

What information can be exposed?

An attacker can enumerate other administrators' network-disk files because the endpoint does not restrict results by admin_uid. The exposed results include file names and download URLs.

CVE-2026-109175: MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What information can be exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What information can be exposed?