CVE-2026-109177 — MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supply…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7