Cyber Posture

CVE-2025-13816

MediumPublic PoC

Published: 01 December 2025

Published
01 December 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0009 24.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Security Summary

CVE-2025-13816, published on 2025-12-01, is a path traversal vulnerability (CWE-22) in moxi159753 Mogu Blog versions up to 5.2. The flaw resides in the FileOperation.unzip function of the /networkDisk/unzipFile endpoint within the ZIP File Handler component. Attackers can exploit it by manipulating the fileUrl argument to traverse directories beyond intended paths.

The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L), without user interaction (UI:N) and with unchanged scope (S:U). It yields limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), scored at CVSS 6.3 under CVSS:3.1, allowing authenticated users to potentially read, modify, or delete files outside the designated unzip directory.

Advisories from VulDB and a GitHub report detail a publicly disclosed proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or official mitigations are available. References include GitHub paths to the exploit report and VulDB entries for further details.

The exploit has been publicly released and may be actively used in attacks.

Details

CWE(s)
CWE-22

Affected Products

mogublog project
mogublog
≤ 5.2

MITRE ATT&CK Enterprise Techniques

T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Path traversal (Zip Slip) in ZIP handler enables exploitation of public-facing web application (T1190), direct volume access for arbitrary file writes (T1006), and deployment of web shells via file overwrites in web directories (T1505.003).

References