UBUNTU-CVE-2026-119553: Path Traversal
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a Moodle account with either question import rights or lesson edit rights. They must be able to upload a crafted ZIP archive using the Blackboard question import format.
What data could be exposed?
The attacker can use ../ sequences in image source values to copy server files into their Moodle draft area. The advisory specifically identifies config.php as an example of a file that may be copied.
Are installations affected by default?
The issue is reachable where users have question import or lesson edit rights and can use the Blackboard question import format. The provided information does not establish whether those permissions are granted by default.
How can I determine whether an instance is in scope?
Check whether the Moodle version is 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, or 4.5.15 or earlier. Also review which users hold question import or lesson edit rights.