MoguBlog CVE-2026-109177

Requires an authenticated administrator account on the target MoguBlog instance (PR:L), and is only meaningful in multi-administrator deployments where more than one admin stores files in the network-disk feature - a single-admin install has no other users' files to target. The attacker must know or guess the victim's file paths, which are supplied directly in the request body to POST /networkDisk/moveFile, batchMoveFile, or edit; the vulnerable code paths update database rows without an admin_uid ownership check. No user interaction (UI:N) and no non-default configuration are needed, but the required admin authentication is the primary factor limiting real-world exploitation to insiders or post-compromise scenarios.

This is a genuine but low-to-moderate priority issue, not a high-severity emergency. The CVSS 4.0 base score is 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and a single integrity impact (VI:L), while confidentiality (VC:N) and availability (VA:N) are rated none - meaning the flaw lets an attacker tamper with the location/names of other users' files but not read their contents or deny service outright. The decisive limiting factor is PR:L: exploitation requires an already-authenticated administrator account, which sharply narrows the realistic attacker population to insiders or someone who has already compromised one admin credential in a multi-admin deployment. A public POC exists (publicly available exploit code exists), so technical exploitation is trivial once authenticated, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - the POC/KEV signals are distinct and should not be conflated. The CWE-639 (authorization bypass through user-controlled key / IDOR) classification is consistent with the description. One signal conflict worth noting: the input Tag labels this 'Authentication Bypass', but the description, CWE-639, and vulncheck advisory all describe broken ACCESS control performed by an already-authenticated admin - this is an authorization/IDOR flaw, not an authentication bypass. Net: a real but bounded post-authentication data-integrity bug in a niche open-source product; patch on a normal cycle rather than as an emergency.

A malicious or compromised low-tier administrator on a shared MoguBlog instance sends crafted POST requests to /networkDisk/moveFile, batchMoveFile, or edit, supplying file paths belonging to another administrator. Because the backend updates rows without validating admin_uid ownership, the attacker relocates or renames the victim's network-disk files and folders, disrupting their stored content. A public POC (poc_networkDisk_ownership.py) automates this, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.