CVE-2025-13814

CriticalCVSS 9.8/10Last modified Sep 26, 2026

Description

A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/uploadPicsByUrl. The manipulation results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
moxi159753	Mogu Blog v2	5.0; 5.1; 5.2

References

https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-ssrf-1/report.mdExploit
https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-ssrf-1/report.md#proof-of-conceptExploit
https://vuldb.com/?ctiid.333823Permissions Required, VDB Entry
https://vuldb.com/?id.333823Third Party Advisory, VDB Entry
https://vuldb.com/?submit.692105Third Party Advisory, VDB Entry

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-138159.8A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures.CVE-2025-138168.8A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of CVE-2025-138186.7Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent CVE-2025-138196.1Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external w CVE-2025-13826.1The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es CVE-2025-138205.3The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an atta CVE-2025-138215.7Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allow CVE-2025-138225.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allow CVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packe CVE-2025-138248.7A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red CVE-2025-138268.2Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is cause CVE-2025-138278.8Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf t