Executive brief
Mogu Blog v2 is a microservice-based blogging platform with separate frontend and backend systems. A vulnerability in the picture upload function allows unauthenticated attackers to make arbitrary network requests from the server and read local files, potentially exposing sensitive configuration and data. The flaw requires no authentication and can be exploited remotely, making it a significant risk to any exposed instance.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in the LocalFileServiceImpl.uploadPictureByUrl method, exposed via the /file/uploadPicsByUrl endpoint. The vulnerable code fails to properly validate the URL parameter passed by clients, allowing attackers to specify arbitrary URLs that the server will fetch and process. An unauthenticated attacker can exploit this to make the server request internal resources, read local files via file:// protocol, or perform network reconnaissance against internal systems. The endpoint lacks authentication controls as evident from WebSecurityConfig configuration. No vendor patch is currently available.
Affected products
- moxi159753 Mogu Blog v2 up to 5.2
Timeline
- 2025-12-01: disclosed: CVE-2025-13814 published
- 2025-12-01: exploited: Exploit released publicly on GitHub