REDHAT-BUG-2543635: Low severity Moodle Moodle vulnerability
Published Sep 29, 2026
·Updated
A flaw was found in Moodle's report builder (corereportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.
Affected Software
1 affected component
Moodle Moodle
Event History
Sep 29, 2026
Data Sourced
via Red Hat·08:36 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What impact has been demonstrated from this issue?
The demonstrated behavior is instantiation of an arbitrary class through insufficient validation of an audience classname. No stronger exploitation primitive has been confirmed.
2
Has code execution or data disclosure been shown to be possible?
No. No exploitable gadget chain leading to code execution, data disclosure, or another stronger impact has been demonstrated.