CVE-2026-26046
Command Injection in Moodle TeX Filter Allows Server Compromise
Publication date: 2026-02-21
Last updated on: 2026-02-26
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moodle | moodle | to 4.5.9 (exc) |
| moodle | moodle | From 5.0.0 (inc) to 5.0.5 (exc) |
| moodle | moodle | From 5.1.0 (inc) to 5.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-26046 is an OS Command Injection vulnerability found in Moodle's TeX filter administrative configuration. It occurs because the input provided by a site administrator to configure the TeX filter is not properly sanitized before being processed by external utilities like ImageMagick."}, {'type': 'paragraph', 'content': 'This means that if an attacker has administrative access, they can enter specially crafted input that causes unintended system commands to be executed on the server running Moodle.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the Moodle TeX filter if it is not required, or restricting administrative access to trusted users only to prevent malicious configuration input.
Additionally, ensure that the Moodle installation is updated with any patches or fixes addressing this vulnerability once they become available.
How can this vulnerability impact me? :
Exploitation of this vulnerability requires administrative privileges, but if successfully exploited, it can lead to full compromise of the Moodle server.
- Unauthorized access to sensitive data stored on the server.
- Disruption of Moodle services, potentially causing downtime.
- Execution of arbitrary system commands, which could be used to install malware or further penetrate the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the Moodle TeX filter is enabled and if ImageMagick is installed on the server. Since exploitation requires administrative privileges and involves command injection via configuration input, monitoring for unusual or unauthorized changes in the TeX filter settings can help identify potential exploitation attempts.
There are no specific commands provided in the available resources to detect exploitation or presence of the vulnerability directly.