Description

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-12T13:17:30.340Z",
  "pubdate": "2026-10-12T13:17:30.340Z",
  "executiveSummary": "MoguBlog versions through 6.2 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the file management system.\nThis vulnerability resides in the network disk functionality, specifically impacting file deletion operations handled via the 'NetworkDiskServiceImpl' class.\nThe flaw allows an authenticated administrator to delete arbitrary files or folders belonging to other administrators by manipulating the 'uid' parameter in POST requests.\nBy bypassing server-side ownership validation, an attacker can purge content from local storage, Qiniu, or MinIO buckets, leading to unauthorized data destruction and potential service disruption.\nExploitation requires authenticated administrative access, making this an elevation of privilege and unauthorized resource deletion issue within the application's administrative control plane.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement proper authorization checks within the 'NetworkDiskServiceImpl.deleteFile' and 'batchDeleteFile' methods. The application fails to validate whether the 'admin_uid' associated with the authenticated session matches the owner of the resource referenced by the provided 'uid' parameter.\nWhen a request is made to 'POST /networkDisk/deleteFile' or 'POST /networkDisk/batchDeleteFile', the server receives the 'uid' of the target file or directory. The backend logic proceeds to execute the deletion command against the underlying storage provider—whether local file system, Qiniu, or MinIO—without enforcing cross-account ownership constraints.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the MoguBlog administrative interface with valid credentials. 2) The attacker identifies the 'uid' of a target file or directory owned by another administrator, typically through information disclosure or enumeration. 3) The attacker crafts a malicious POST request to the vulnerable endpoints, supplying the target 'uid'. 4) The server receives the request, identifies the authorized session, but fails to check if the attacker has ownership rights over the resource associated with the specified 'uid'. 5) The 'NetworkDiskServiceImpl' invokes the deletion routine, permanently removing the target object from the configured storage medium.\nThis IDOR vulnerability effectively transforms the file deletion API into an arbitrary file removal tool for any administrator account. Because the application logic relies on client-supplied identifiers without server-side validation, the integrity of stored objects is compromised. The impact is significant in multi-admin environments where resource isolation is expected. The flaw remains persistent across all storage backends configured within MoguBlog, including cloud-based storage services like Qiniu or MinIO, meaning the scope of destruction is not limited to the local web server environment.\nThe vulnerability is present in MoguBlog through version 6.2. There is no implicit requirement for public network exposure, as the endpoints are restricted to authenticated administrators; however, the lack of granular access control at the service layer creates a critical security deficiency in the application's administrative backend."
}