This vulnerability exists in the LocalFileServiceImpl.uploadPictureByUrl function of the Picture Storage Service in moxi624 Mogu Blog v2 (up to version 5.2). It allows an attacker to perform server-side request forgery by manipulating the URL parameter used to upload pictures, potentially causing the server to make unintended requests. The vulnerability is remotely exploitable without authentication. The vendor was notified but has not issued any patch or advisory. No official remediation or mitigation guidance is currently available.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. The CVSS score of 6.9 indicates a medium impact, reflecting the potential for information disclosure or limited internal network access. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service as a temporary mitigation. Monitor for any updates from the vendor or trusted security sources regarding patches or official mitigations.