CVE-2025-13814mediumCWE-918

CVE-2025-13814: medium-severity vulnerability in moxi159753 Mogu Blog v2

moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery

Published

Follow this CVE+ Monitor Mogu Blog

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/uploadPicsByUrl. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
moxi159753 · Mogu Blog v2
Related CVEs — moxi159753 Mogu Blog v2

In the same product, most dangerous first.

CVE-2025-13816MEDIUMmoxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversalEPSS 0.7%CVE-2025-13813MEDIUMmoxi159753 Mogu Blog v2 Storage Management Endpoint storage authorizationEPSS 0.5%CVE-2025-13815MEDIUMmoxi159753 Mogu Blog v2 pictures unrestricted uploadEPSS 0.4%