A function in Mogu Blog v2's Picture Storage Service, LocalFileServiceImpl.uploadPictureByUrl, allows an attacker to supply a URL that the server will retrieve. This vulnerability is a classic server-side request forgery (SSRF) that can lead to data leakage, internal network reconnaissance, and potential execution of further attacks against services reachable from the server. The weakness is identified as CWE-918 and can be exploited by sending crafted requests to the application, enabling unauthorized outbound connections.

Products listed by the CNA include moxi624 Mogu Blog v2, up through version 5.2. Any installation of that software that has not applied a fix for the SSRF in LocalFileServiceImpl.uploadPictureByUrl is affected. Because the vulnerability exists in code that is part of the picture storage component, it is likely present on all deployments of the identified version range.

The CVSS score of 6.9 reflects moderate severity with potential for moderate impact if exploited. EPSS is not available, so the current likelihood of exploitation is uncertain, but the public disclosure and reported exploitability imply that it could be abused. The vulnerability is not listed in CISA's KEV catalog. Attackers can trigger it remotely by invoking the exposed uploadPictureByUrl endpoint, and the absence of input validation allows outbound requests to arbitrary destinations. Unless mitigated, attackers could access internal resources or cause the application to perform unintended outbound actions.