CVE-2026-102577: Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass
A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).
Other sources
A flaw was found in Moodle's URL downloader. Incorrect handling of IPv4-mapped IPv6 addresses in the host-blocking logic allows an authenticated user to bypass some blocked-host restrictions, resulting in a server-side request forgery (SSRF) risk when the downloader fetches a crafted URL. No further impact beyond partial blocklist bypass has been demonstrated.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be an authenticated remote user. No user interaction is required, and the attacker needs to provide a crafted URL to the URL downloader.
What is the demonstrated impact of a successful bypass?
The demonstrated impact is a partial bypass of blocked-host restrictions, allowing the server-side downloader to request restricted destinations. No further impact beyond the partial blocklist bypass has been demonstrated.