Moodle LMS (Product): news timeline & CVEs

Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Maintainers will not fix a Moodle 3.9.2 upload bypass to RCE unless current LTS versions are affected.

An oss-security reply discusses a reported authenticated file-upload validation bypass (CWE-434) in Moodle LMS 3.9.2 that could lead to remote code execution under misconfiguration. The poster says security bug fixes for the 3.9.x line ended on 11 December 2023, while newer 5.x releases exist and Moodle 5.4 LTS was expected within the week. They state no fix will be issued unless the issue is reproducible on a supported long-term support version.

oss-securitySep 30, 08:47 UTC · 8d agoVulnerability

Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Poster questions a CVE for an authenticated Moodle 3.9.2 upload bypass that needs misconfiguration for RCE.

An oss-security thread discusses an authenticated file-upload validation bypass (CWE-434) in Moodle LMS 3.9.2 that could lead to remote code execution only under misconfiguration. Michael Straßberger notes that Moodle 3.9 no longer has security support and asks whether the behavior reproduces on at least Moodle 4.1.22. He argues a CVE should not be issued if supported releases are unaffected, citing already high advisory volume. No CVE identifier or observed exploitation is stated.

oss-securitySep 29, 07:48 UTC · 9d agoVulnerability

Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Researcher reports an authenticated Moodle 3.9.2 file-upload bypass that can yield RCE if misconfigured.

A researcher disclosed an authenticated unrestricted file-upload flaw (CWE-434 and CWE-20) in Moodle LMS 3.9.2 that can lead to remote code execution when the site is misconfigured. Other versions have not been verified. Moodle, a CVE Numbering Authority, has not assigned a CVE after coordinated disclosure, and a MITRE request tracked as CAN-2026-2032565 has been pending for about three months.

oss-securitySep 29, 02:33 UTC · 10d agoVulnerability

Moodle LMS

Timeline3 articles

Appears with

Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration