Is CVE-2025-13814 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13814 being exploited in the wild.

How severe is CVE-2025-13814?

High severity, with a CVSS score of 7.3, published 1 December 2025.

Which products and versions are affected?

Moxi159753 Mogu Blog v2 up to 5.2.

Is there a fix for CVE-2025-13814?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13814 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-13814?

Check whether you run Mogublog Project Mogublog or Moxi159753 Mogu Blog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13814: moxi159753 Mogu Blog server-side request forgery in file upload

CVE-2025-13814 · Severity: high · CVSS 7.3 · Published 2025-12-01

Mogu Blog v2 is a microservice-based blogging platform with separate frontend and backend systems. A vulnerability in the picture upload function allows unauthenticated attackers to make arbitrary network requests from the server and read local files, potentially exposing sensitive configuration and data. The flaw requires no authentication and can be exploited remotely, making it a significant risk to any exposed instance.

Technologies: Mogublog Project Mogublog, Moxi159753 Mogu Blog. Vendors: Mogublog Project, Moxi159753.

Quick answers

Is CVE-2025-13814 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13814 being exploited in the wild.
How severe is CVE-2025-13814?: High severity, with a CVSS score of 7.3, published 1 December 2025.
Which products and versions are affected?: Moxi159753 Mogu Blog v2 up to 5.2.
Is there a fix for CVE-2025-13814?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13814 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-13814?: Check whether you run Mogublog Project Mogublog or Moxi159753 Mogu Blog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in the LocalFileServiceImpl.uploadPictureByUrl method, exposed via the /file/uploadPicsByUrl endpoint. The vulnerable code fails to properly validate the URL parameter passed by clients, allowing attackers to specify arbitrary URLs that the server will fetch and process. An unauthenticated attacker can exploit this to make the server request internal resources, read local files via file:// protocol, or perform network reconnaissance against internal systems. The endpoint lacks authentication controls as evident from WebSecurityConfig configuration. No vendor patch is currently available.

Affected products

moxi159753 Mogu Blog v2 up to 5.2

Timeline

2025-12-01: disclosed: CVE-2025-13814 published
2025-12-01: exploited: Exploit released publicly on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.