CVE-2026-6625
Published: 20 April 2026
Summary
CVE-2026-6625 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2026-6625 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting moxi624 Mogu Blog versions up to 5.2. The issue resides in the LocalFileServiceImpl.uploadPictureByUrl function within the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceImpl.java of the Picture Storage Service component. Published on 2026-04-20, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers can exploit this vulnerability without authentication or user interaction by manipulating the uploadPictureByUrl function, enabling SSRF to make unauthorized requests from the server. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as accessing internal resources or services otherwise unreachable from the internet.
Advisories from VulDB (vuldb.com/vuln/358260 and related pages) and a public exploit disclosure on GitHub (github.com/ccccccctiiiiiiii-lab/public_exp/issues/3) detail the issue, noting that the vendor was contacted early but provided no response or patch. No official mitigations or fixes are available, urging practitioners to restrict network access to the affected service or implement input validation on URL parameters until remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23821
Vulnerability details
A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceImpl.java of the component Picture Storage Service. The manipulation leads to server-side request forgery. It…
more
is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability in unauthenticated public-facing web app directly enables remote exploitation for initial access via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of URL inputs to the LocalFileServiceImpl.uploadPictureByUrl function, directly preventing SSRF by rejecting malicious or unauthorized URLs.
Enforces information flow control policies to restrict unauthorized server-side requests from the Picture Storage Service to internal resources exploited via SSRF.
Monitors and controls outbound communications at system boundaries, blocking SSRF attempts by the vulnerable service to access internal networks or services.