CVE-2026-109176: MoguBlog 0 through 6.2

Affected technology

MoguBlog · 0 through 6.2
moxi624

Description’s affected range: through 6.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality impact as none; integrity and availability impact as low.