CVE-2026-109176

5.4Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-639

Impact

Authenticated administrators can permanently delete other administrators' files and folders across local storage, Qiniu, or MinIO. Attackers need valid administrator credentials and network access to the MoguBlog API.

Root cause

The deleteFile and batchDeleteFile endpoints in NetworkDiskServiceImpl delete files by user-provided UID without verifying that the requesting admin_uid matches the owner.

Affected systems

MoguBlog through 6.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Fix & remediation

No fixed version is currently specified in the advisory. Block access to the POST /networkDisk/deleteFile and POST /networkDisk/batchDeleteFile endpoints at your reverse proxy or WAF until a patch is applied.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109176