# CVE-2025-13813: Moxi159753 Mogu Blog v2 authentication bypass in storage management

Source: https://junglewise.ai/threats/cve-2025-13813-moxi159753-mogu-blog-v2-authentication-bypass-in-storage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-13813 · Severity: medium · CVSS 5.6 · Published 2025-12-01

Mogu Blog v2 is a self-hosted blogging platform that manages file storage and quotas for users. An unauthenticated attacker can remotely manipulate storage quota allocations for administrator accounts, potentially causing service disruption or unauthorized storage expansion without needing valid login credentials.

Technologies: [Mogublog Project Mogublog](https://junglewise.ai/threats/technologies/mogublog). Vendors: [Mogublog Project](https://junglewise.ai/threats/vendors/mogublog-project), [Moxi159753](https://junglewise.ai/threats/vendors/moxi159753).

## Quick answers

**Is CVE-2025-13813 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13813 being exploited in the wild.

**How severe is CVE-2025-13813?** Medium severity, with a CVSS score of 5.6, published 1 December 2025.

**Which products and versions are affected?** Moxi159753 Mogu Blog v2 up to 5.2.

**Is there a fix for CVE-2025-13813?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13813 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-13813?** Check whether you run Mogublog Project Mogublog or Moxi159753 Mogu Blog v2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication vulnerability exists in the storage management endpoints (/storage/initStorageSize and /storage/editStorageSize) of Mogu Blog v2 due to improper Spring Security configuration that uses permitAll() for /storage/** endpoint patterns. The vulnerable component (StorageRestApi.java and StorageServiceImpl.java) fails to validate user identity before processing storage quota modification requests. An unauthenticated attacker can send network requests to these endpoints to arbitrarily modify storage quotas assigned to any administrator account, achieving denial of service or unauthorized resource expansion. The exploit is publicly available and no vendor patch has been provided despite early notification.

## Affected products

- moxi159753 Mogu Blog v2 up to 5.2

## Timeline

- 2025-12-01: disclosed
- other: Exploit publicly available; vendor did not respond to early notification

## References

- [https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md](https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md)
- [https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md](https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-broken_access_control-1/report.md)

## Related threats

- [Mogu Blog v2 path traversal in ZIP file handler](https://junglewise.ai/threats/cve-2025-13816-mogu-blog-v2-path-traversal-in-zip-file-handler)
- [moxi159753 Mogu Blog unrestricted file upload](https://junglewise.ai/threats/cve-2025-13815-moxi159753-mogu-blog-unrestricted-file-upload)
- [moxi159753 Mogu Blog server-side request forgery in file upload](https://junglewise.ai/threats/cve-2025-13814-moxi159753-mogu-blog-server-side-request-forgery-in-file-upload)