CVE-2025-13815 is a medium severity unrestricted file upload flaw (CVSS 6.3) in moxi159753 Mogu Blog v2 (up to 5.2), affecting the /file/pictures endpoint, through the filedatas argument. No fix is listed and the vendor did not respond, so cut exposure and watch for a patch.
What's affected
The affected component is the /file/pictures endpoint, through the filedatas argument. The record says manipulating the filedatas argument causes unrestricted upload, and the attack can be started remotely.
Affected version: up to 5.2. The record names no fixed version and says the vendor was contacted early but did not respond.
The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first. The weakness classes are CWE-284, CWE-434.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
Find the Mogu Blog v2 deployments and note the version. The record covers versions up to 5.2. The project is a Java application, so look at the deployed artifacts.
find / -name "mogu*" -maxdepth 4 2>/dev/null | head
ls -la /path/to/upload/directory
Then inspect the upload directory for file types that a blog should never store, such as scripts or executables. Check that the directory is not served with execute permission by your web server or reverse proxy.
Finally, check which accounts can reach the endpoint. The CVSS vector requires low privileges, so a registered user is enough.
What to do now
- Locate every Mogu Blog v2 instance and record its version.
- Disable open registration if you do not need it, since the vector needs a low-privilege account.
- Store uploads outside the web root, or on object storage with no script execution, and serve them with a fixed safe content type.
- Allow only the image types you need, check content and not just the file extension, and rename files on upload.
- Inspect the upload directory for files that should not be there, and remove them after preserving copies for investigation.
- The record says the vendor did not respond, so plan to patch the code yourself or move off the project.
Why it matters
Unrestricted upload (CWE-284, CWE-434) means the application accepts files without enough checks on their type, name or destination. The danger depends on what happens next: if the file is stored where the server can run it, an upload can become code execution.
Even without execution, open uploads let people host malware or illegal content on your domain. Treat any file upload as an untrusted input path and design for that from the start.
Quick check
Why is the severity only medium?
The vector requires a low-privilege account and lists limited impact on each of confidentiality, integrity and availability. The attack vector is the network, and the vector lists low privileges required, so an attacker needs some kind of valid account first.
Is there a fixed version?
The record names no fixed version and says the vendor was contacted early but did not respond.
Sources
- Gold vulnerability page for CVE-2025-13815
- CVE record for CVE-2025-13815 as published by its CNA, with a published date of 2025-12-01
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
