CVE-2026-26045
Received Received - Intake
Server-Side Code Execution via Moodle Backup Restore Flaw

Publication date: 2026-02-21

Last updated on: 2026-02-26

Assigner: Fedora Project

Description
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-21
Last Modified
2026-02-26
Generated
2026-06-16
AI Q&A
2026-02-21
EPSS Evaluated
2026-06-14
NVD
CVE-2026-26045
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
moodle moodle to 4.5.9 (exc)
moodle moodle From 5.0.0 (inc) to 5.0.5 (exc)
moodle moodle From 5.1.0 (inc) to 5.1.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': "This vulnerability exists in Moodle's backup restore functionality where specially crafted backup files are not properly validated during processing."}, {'type': 'paragraph', 'content': 'An authenticated user with restore permissions can upload a malicious backup file that, when restored, may lead to unintended execution of server-side code, specifically arbitrary PHP code.'}, {'type': 'paragraph', 'content': 'This flaw can result in a complete compromise of the Moodle server.'}] [1]

Mitigation Strategies

To mitigate this vulnerability, ensure that only trusted and authenticated users with restore permissions can upload and restore backup files in Moodle.

Restrict access to the restore functionality to minimize the risk of malicious backup files being processed.

Monitor for updates or patches from Moodle or your Linux distribution and apply them promptly to fix the improper validation issue.

Impact Analysis

Successful exploitation of this vulnerability can lead to full compromise of the Moodle instance.

  • Unauthorized data access
  • System modification
  • Potential service disruption
Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart