Mogu Blog Vulnerability: SSRF Allows Remote Server Takeover
The National Vulnerability Database has disclosed CVE-2026-6625, a critical Server-Side Request Forgery (SSRF) vulnerability impacting Mogu Blog versions up to 5.2. The flaw resides in the LocalFileServiceImpl.uploadPictureByUrl function within the Picture Storage Service component. Attackers can exploit this remotely to trick the server into making unintended requests, potentially leading to unauthorized data access or further system compromise. The vendor was notified but failed to respond, leaving users exposed.
This SSRF flaw, rated HIGH with a CVSS score of 7.3, is particularly dangerous because it requires no authentication and can be initiated over the network. The lack of vendor response is concerning, suggesting a high likelihood of exploitation given the public disclosure. Defenders must prioritize patching or mitigating this vulnerability to prevent attackers from leveraging it to pivot within their networks.
What This Means For You
- If your organization uses Mogu Blog v5.2 or earlier, you must immediately investigate and apply any available patches. Audit your Picture Storage Service logs for any unusual outbound network requests originating from the blog server. Given the public disclosure and lack of vendor engagement, assume this vulnerability is actively being exploited.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6625 Mogu Blog SSRF via uploadPictureByUrl
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6625 | Vulnerability | CVE-2026-6625 |
| CVE-2026-6625 | Affected Product | moxi624 Mogu Blog v2 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 20, 2026 at 13:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-6636 — P2r3 Convert Path Traversal
CVE-2026-6636 — A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API....
Rowboat Labs Tool Exposed by Improper Authentication Vulnerability
CVE-2026-6635 — A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function tool_call of the file apps/experimental/tools_webhook/app.py of the...
CVE-2026-6634 — The Function Memos_access_token Of The File Src/App.Tsx Of T Vulnerability
CVE-2026-6634 — A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component...