CVE-2026-26045

7.2 highEPSS 0.6%

High (7.2) in moodle moodle. EPSS 0.6% chance of exploitation in the next 30 days.

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.

Severity

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2026-02-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

moodle:moodle

References

https://access.redhat.com/security/cve/CVE-2026-26045
https://bugzilla.redhat.com/show_bug.cgi?id=2440901

Check your stack JSON