CVE-2026-26045
Received Received - Intake
Server-Side Code Execution via Moodle Backup Restore Flaw

Publication date: 2026-02-21

Last updated on: 2026-02-26

Assigner: Fedora Project

Description
A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-21
Last Modified
2026-02-26
Generated
2026-05-27
AI Q&A
2026-02-21
EPSS Evaluated
2026-05-25
NVD
CVE-2026-26045
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
moodle moodle to 4.5.9 (exc)
moodle moodle From 5.0.0 (inc) to 5.0.5 (exc)
moodle moodle From 5.1.0 (inc) to 5.1.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, ensure that only trusted and authenticated users with restore permissions can upload and restore backup files in Moodle.

Restrict access to the restore functionality to minimize the risk of malicious backup files being processed.

Monitor for updates or patches from Moodle or your Linux distribution and apply them promptly to fix the improper validation issue.


Can you explain this vulnerability to me?

[{'type': 'paragraph', 'content': "This vulnerability exists in Moodle's backup restore functionality where specially crafted backup files are not properly validated during processing."}, {'type': 'paragraph', 'content': 'An authenticated user with restore permissions can upload a malicious backup file that, when restored, may lead to unintended execution of server-side code, specifically arbitrary PHP code.'}, {'type': 'paragraph', 'content': 'This flaw can result in a complete compromise of the Moodle server.'}] [1]


How can this vulnerability impact me? :

Successful exploitation of this vulnerability can lead to full compromise of the Moodle instance.

  • Unauthorized data access
  • System modification
  • Potential service disruption

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart