Is there a public PoC exploit available for CVE-2025-13816?

Yes, a public proof-of-concept exploit is available for CVE-2025-13816. Prioritise patching immediately. EPSS: 0.1%.

Mogu Blog CVE-2025-13816

Q: What is the CVSS score of CVE-2025-13816?

CVE-2025-13816 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-199973 LOW

Path Traversal (CWE-22)

2025-12-01 cna@vuldb.com

Path Traversal Mogublog Mogublog Project

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

PR:L required for endpoint; path traversal leads to arbitrary file write (I:H), no confidentiality loss, limited availability impact (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-199973

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Dec 03, 2025 - 22:02 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 09:16 nvd

MEDIUM 6.3

CVE Published

Dec 01, 2025 - 09:16 cve.org

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler. Such manipulation of the argument fileUrl leads to path traversal. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories via the /networkDisk/unzipFile endpoint. The vulnerability exists in the FileOperation.unzip function processing the fileUrl argument without proper sanitization, enabling ZIP slip-style extraction. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV; the EPSS probability is low (0.15%).

Technical ContextAI

The flaw resides in the ZIP file handler component of Mogu Blog, a Java-based blogging platform. The endpoint /networkDisk/unzipFile, implemented in the FileOperation.unzip method, accepts a fileUrl parameter that points to a ZIP archive. The extraction process fails to validate file paths inside the archive, allowing an attacker to craft filenames containing directory traversal sequences (e.g., ../../). This is a classic CWE-22 (Path Traversal) weakness commonly seen in archive extraction routines. The affected CPE is cpe:2.3:a:mogublog_project:mogublog:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch is available as the vendor did not respond. Immediate mitigation actions include disabling the /networkDisk/unzipFile endpoint if not required, implementing strict input validation on the fileUrl parameter to reject directory traversal patterns, and ensuring that ZIP extraction is always confined to a secure temporary directory with path canonicalization. As a workaround, restrict access to the unzip functionality to highly trusted roles only. If the endpoint cannot be disabled, deploy a web application firewall rule to block requests containing '..%2F' or '../' in the fileUrl parameter. Monitor excessive file system writes as an indicator of exploitation. The POC is at https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-zip_slip-1/report.md.