CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Score

CVSS 3.1 8.8 High

Status

Analyzed - patrick@puiterwijk.org

Published

2026-09-30

Last modified

2026-10-01

Weaknesses

CWE-89

Affected products

• Moodle (Moodle)

References

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-89383
• https://access.redhat.com/security/cve/CVE-2026-102578
• https://bugzilla.redhat.com/show_bug.cgi?id=2543632
• https://moodle.org/mod/forum/discuss.php?d=482496