CVE-2026-109175 — MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POS…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7