Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109174— MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

Quick assessment

Affected
moxi624 MoguBlog
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MoguBlog 版本 6.2 及之前存在一个信息泄露漏洞，允许低权限的前端用户通过 getSystemConfig 端点读取系统凭证。攻击者可以提供普通的读者会话令牌，以获取未经过滤的系统配置数据，从而暴露七牛（Qiniu）和 MinIO 的密钥以及 SMTP 邮箱的密码。

CVSS 6.5 · Medium EPSS 0.24% · P13

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
moxi624 MoguBlog ≤ 6.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109174

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
Source: CVE Program / CVE List V5
Vulnerability Description
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
moxi624 MoguBlog 0 ~ 6.2 -

II. Public POCs for CVE-2026-109174

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109174

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109174 (1)

Proof of Concept for CVE-2026-109174 (1)

Same Patch Batch · moxi624 · 2026-10-12 · 4 CVEs total

CVE-2026-109176 5.4 MEDIUM MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
CVE-2026-109175 4.3 MEDIUM MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
CVE-2026-109177 4.3 MEDIUM MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

IV. Related Vulnerabilities

Same product: MoguBlog
Same vendor: moxi624
Same weakness: CWE-863

V. Comments for CVE-2026-109174

No comments yet

Leave a comment