MoguBlog CVE-2026-109175

Requires a valid authenticated administrator session on a MoguBlog instance (through version 6.2) and the presence of the network-disk feature, since exploitation is a direct POST to the /networkDisk/getFileList endpoint. The flaw is inherent to default behavior - the getFileList query filters only by status, file type, or filePath and never by admin_uid - so no special non-default configuration is needed. The principal limiting factor is the PR:L authentication requirement (a low-privilege admin account), and realistic risk is highest in multi-administrator or shared-tenant deployments; single-administrator installations have little to disclose. No user interaction is required.

This is a medium-severity authorization flaw (CWE-639, IDOR) whose real-world risk is modest and well-bounded. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the description agree internally: exploitation is network-reachable and low-complexity but requires an authenticated administrator account (PR:L), and impact is confined to confidentiality of other administrators' network-disk file names and download URLs (VC:L, no integrity or availability impact). Public exploit code exists (a VulnCheck-referenced GitHub PoC), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the PoC availability and the lack of KEV are consistent with an opportunistic/post-authentication issue rather than a mass-exploited one. The key limiting factor is the PR:L requirement: an attacker must already hold a valid administrator session, which sharply narrows the realistic threat population to malicious or compromised low-privilege admin accounts. Net assessment: a legitimate but lower-tier priority - patch in normal cycles, prioritize only where multiple semi-trusted administrators share an instance. One caveat: no EPSS value was supplied, so quantitative exploitation probability could not be factored in.

A malicious or compromised low-privileged administrator on a shared MoguBlog instance sends a crafted POST request to /networkDisk/getFileList, which filters results only by status, file type, or filePath and never by admin_uid. The response discloses other administrators' file names and download URLs, which the attacker can then use to retrieve files they were never authorized to access. A public proof-of-concept script (poc_networkDisk_read_unzip.py) automating this read is already available.