GitHub Advisoryadvisory · Packagist

GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore

HIGH Published 2026-02-21 Modified 2026-02-25 Official page ↗
Aliases
CVE-2026-26045
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2026-02-25

Affected packages

• Packagist moodle/moodle: >= 5.1.0-beta, < 5.1.2 → fixed in 5.1.2 • Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.5 → fixed in 5.0.5 • Packagist moodle/moodle: < 4.5.9 → fixed in 4.5.9

Description

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.

Related

Alias · CVE (1)

  • CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References