Description

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:30.490Z",
  "pubdate": "2026-10-12T13:17:30.490Z",
  "executiveSummary": "MoguBlog through version 6.2 is susceptible to a broken access control vulnerability originating from insufficient authorization checks within the network-disk management module. The flaw allows an authenticated administrator to manipulate file system objects belonging to other administrative users. By exploiting this vulnerability, an attacker can move or rename files and directories across the application's network storage infrastructure without undergoing proper identity verification or ownership validation. The vulnerability exists because the backend controllers fail to verify the association between the requester's admin_uid and the targeted file resource prior to executing write operations. This results in an insecure direct object reference (IDOR) scenario, enabling unauthorized administrative actions that can lead to data loss, disruption of service, or the unauthorized restructuring of sensitive data. Exploitation requires active authentication as an administrator; however, once inside, the attacker possesses the capability to alter any file within the network-disk system, undermining the integrity and availability of the platform's file management architecture.",
  "technicalDetails": "The vulnerability resides in the backend logic handling network-disk operations within MoguBlog, specifically targeting the endpoints /networkDisk/moveFile, batchMoveFile, and edit. The root cause of this security defect is an improper implementation of access control mechanisms where the application assumes that the caller's administrative status is sufficient to perform operations on any resource managed by the network-disk component. The application architecture fails to enforce an ownership check (admin_uid validation) when processing requests to modify file system paths.\nDuring the exploitation process, an authenticated administrator initiates a POST request to one of the identified vulnerable endpoints. The request includes parameters specifying the target file path and the destination path or new filename. Because the backend controller does not perform a cross-reference between the session-based admin_uid and the owner of the requested file object, the application updates the underlying database rows and filesystem pointers for any object identified in the request. This lack of validation facilitates an IDOR-style attack where the authorization scope is improperly widened to include the entire network storage environment rather than the individual administrator's scope.\nThe attack flow follows a structured trajectory: First, the attacker identifies the file path structure of other administrative users through legitimate observation or enumeration. Second, the attacker crafts a malicious POST request directed at the vulnerable endpoints, substituting the target file path for one belonging to an external entity. Third, the server processes the request, updating the database record corresponding to the file path without verifying if the requester possesses legitimate ownership or administrative rights over that specific object. The application then performs the move or rename operation globally within the network-disk structure.\nThis vulnerability is present in MoguBlog versions through 6.2. The primary component involved is the file management service, which handles user-uploaded content and directory organization. The impact of successful exploitation is significant, as it grants malicious actors the ability to rename critical system files, relocate user data to inaccessible directories, or effectively delete files by moving them into obscure path locations. This manipulation occurs without alerting the actual owner or system logs of the unauthorized intervention, as the operations mimic standard administrative activity."
}