CVE-2026-109175

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated administrators can read other administrators' file names and download URLs from the network disk. An attacker only needs low-privileged admin account access to query the endpoint.

Root cause

The /networkDisk/getFileList endpoint omits an admin_uid filter when querying files, relying only on status, file type, or file path.

Affected systems

MoguBlog through 6.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

No fixed version is specified in the advisory; restrict or block access to the POST /networkDisk/getFileList endpoint at your reverse proxy or WAF while auditing admin accounts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109175