CVE-2026-109177: MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

Q: Who can exploit this issue?

An authenticated administrator can exploit it. The attacker needs to know or supply the path of another administrator's network-disk file or folder.

Q: Which operations and endpoints are affected?

The affected operations are moving, batch-moving, and editing network-disk items through POST requests to /networkDisk/moveFile, batchMoveFile, or edit.

Q: What is the practical impact?

An attacker can relocate or rename files and folders belonging to other administrators. The described impact is integrity-related; no confidentiality or availability impact is stated.

Q: How can I determine whether my deployment is affected?

MoguBlog versions through 6.2 are affected. The vulnerable behavior occurs when the relevant endpoints update network-disk records without verifying that admin_uid matches the owner.

Published Oct 12, 2026

Updated

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without adminuid checks, relocating or renaming other users' files and folders.

Affected Software

1 affected component

MoguBlog MoguBlog<=6.2

Event History

Oct 12, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated administrator can exploit it. The attacker needs to know or supply the path of another administrator's network-disk file or folder.

Which operations and endpoints are affected?

The affected operations are moving, batch-moving, and editing network-disk items through POST requests to /networkDisk/moveFile, batchMoveFile, or edit.

What is the practical impact?

An attacker can relocate or rename files and folders belonging to other administrators. The described impact is integrity-related; no confidentiality or availability impact is stated.

How can I determine whether my deployment is affected?

MoguBlog versions through 6.2 are affected. The vulnerable behavior occurs when the relevant endpoints update network-disk records without verifying that admin_uid matches the owner.

CVE-2026-109177: MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which operations and endpoints are affected?

What is the practical impact?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which operations and endpoints are affected?

What is the practical impact?

How can I determine whether my deployment is affected?