Information Disclosure Vulnerability in MoguBlog Affects User Credentials
CVE-2026-109174

7.1HIGH

Key Information:

Vendor

Moxi624

Status
Mogublog
Vendor
CVE Published:
12 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109174?

MoguBlog versions up to and including 6.2 are susceptible to an information disclosure vulnerability. This flaw allows low-privileged front-end users to access sensitive system credentials through the getSystemConfig endpoint. By exploiting this vulnerability, attackers can utilize a regular reader session token to obtain unfiltered SystemConfig data, potentially revealing critical information such as Qiniu and MinIO secret keys along with SMTP mailbox passwords. It is imperative for users of MoguBlog to apply security updates and review access controls to protect against unauthorized disclosure of sensitive data.

Affected Version(s)

MoguBlog 0 <= 6.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109174 - Proof of Concept

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e...
technical-description
https://www.vulncheck.com/advisories/mogublog-through-6.2...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.