Is CVE-2026-109175 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109175?

CVE-2026-109175 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109175

Description

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.