Is CVE-2026-109177 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109177?

CVE-2026-109177 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-109177

Description

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.