CVE-2026-109175Published

MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109175 · Microsoft / collected KEV context

cve-program · CVE-2026-109175

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_networkDisk_read_unzip.py
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/restapi/NetworkDiskRestApi.java#L70-L76
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/NetworkDiskServiceImpl.java#L89-L121
https://www.vulncheck.com/advisories/mogublog-through-6.2-broken-access-control-via-networkdisk-getfilelist

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.