CVE-2026-26045
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.
- Score
- CVSS 3.1 7.2 High
- Status
- Analyzed - patrick@puiterwijk.org
- Published
- 2026-02-21
- Last modified
- 2026-02-26
- Weaknesses
- CWE-94
Affected products
References
- https://access.redhat.com/security/cve/CVE-2026-26045
- https://bugzilla.redhat.com/show_bug.cgi?id=2440901
