PT-2025-48430 · Unknown · Mogu Blog V2

Sh7Err05 · Published 2025-12-01 · Updated 2025-12-03 · CVE-2025-13816

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions moxi159753 Mogu Blog v2 versions up to 5.2

Description A security issue exists in moxi159753 Mogu Blog v2. The FileOperation.unzip function within the ZIP File Handler component, located in the /networkDisk/unzipFile file, is susceptible to path traversal due to manipulation of the fileUrl argument. This allows for remote attacks. The exploit for this issue has been publicly disclosed. The vendor was informed of this disclosure but did not provide a response.

Recommendations Versions up to 5.2: Address the path traversal issue in the FileOperation.unzip function by validating the fileUrl argument to prevent manipulation. As a temporary workaround, restrict access to the /networkDisk/unzipFile file.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13816

Affected Products

Mogu Blog V2

References · 12

• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-zip_slip-1/report.md · Exploit
• 🔥 https://github.com/Xzzz111/exps/blob/main/archives/mogu_blog_v2-zip_slip-1/report.md#proof-of-concept · Exploit
• https://osv.dev/vulnerability/CVE-2025-13816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13816 · Security Note
• https://vuldb.com/?ctiid.333825 · Note
• https://t.me/cveNotify/144384 · Telegram Post
• https://t.me/CVEtracker/38525 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995456013172920534 · Twitter Post
• https://vuldb.com/?id.333825 · Note
• https://t.me/cveNotify/144695 · Telegram Post
• https://vuldb.com/?submit.692107 · Note
• https://twitter.com/CVEnew/status/1995423604691939821 · Twitter Post