Executive brief
Mogu Blog is an open-source blog platform. A stored cross-site scripting (XSS) vulnerability allows authenticated users with blog category management permissions to inject malicious scripts into category names. When other users view articles in the affected category, the injected script executes in their browser, potentially stealing session tokens, redirecting users to malicious sites, or defacing content.
Technical details
This is a stored (persistent) cross-site scripting vulnerability in the blog category name field (BlogSort.sortName). The vulnerability exists in the BlogSortServiceImpl.addBlogSort and editBlogSort methods, which fail to sanitize or HTML-encode the sortName parameter before persisting it to the database. The vulnerable data is then rendered without escaping in the Freemarker template (mogu_web/src/main/resources/templates/info.ftl at lines 43 and 51) on the public-facing article detail page. An authenticated backend user with category management permissions (not necessarily a superadmin) can inject arbitrary HTML/JavaScript through the /blogSort/add or /blogSort/edit endpoints. Any visitor subsequently viewing an article in the affected category will trigger the malicious script execution in their browser context. The vulnerability affects versions 4.0 through 5.2 and the current source code.
Affected products
- moxi624 Mogu Blog v4.0 through v5.2
Timeline
- 2026-08-01: disclosed: Vulnerability reported via Gitee issue #IK5STW
- 2026-09-13: advisory: CVE-2026-90568 published