CVE-2025-13816

MediumPublic PoCUpdated

Published: 01 December 2025

Published

01 December 2025

Modified

29 April 2026

KEV Added

—

Patch

—

CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS Score 0.0011 29.7th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13816 is a medium-severity Path Traversal (CWE-22) vulnerability in Mogublog Project Mogublog. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Volume Access (T1006); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Direct Volume Access (T1006) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly validates the fileUrl argument in the FileOperation.unzip function to block path traversal sequences like ../

SI-2 Flaw Remediation good match

prevent

Requires identification and timely correction of the path traversal flaw in the ZIP File Handler's unzip endpoint.

AC-6 Least Privilege partial match

prevent

Limits privileges of authenticated low-privilege users and the unzip process to restrict access to files outside the intended directory even if traversal occurs.

MITRE ATT&CK Enterprise TechniquesAI

T1006 Direct Volume Access Stealth

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Path traversal (Zip Slip) in ZIP handler enables exploitation of public-facing web application (T1190), direct volume access for arbitrary file writes (T1006), and deployment of web shells via file overwrites in web directories (T1505.003).

NVD Description

A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler. Such manipulation of the argument fileUrl leads to path…

traversal. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2025-13816, published on 2025-12-01, is a path traversal vulnerability (CWE-22) in moxi159753 Mogu Blog versions up to 5.2. The flaw resides in the FileOperation.unzip function of the /networkDisk/unzipFile endpoint within the ZIP File Handler component. Attackers can exploit it by manipulating the fileUrl argument to traverse directories beyond intended paths.

The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L), without user interaction (UI:N) and with unchanged scope (S:U). It yields limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), scored at CVSS 6.3 under CVSS:3.1, allowing authenticated users to potentially read, modify, or delete files outside the designated unzip directory.

Advisories from VulDB and a GitHub report detail a publicly disclosed proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are available. References include GitHub paths to the exploit report and VulDB entries for further details.

The exploit has been publicly released and may be actively used in attacks.