https://seclists.org/oss-sec/2026/q3/1002: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Published Sep 29, 2026
·Updated
Affected Software
1 affected component
Moodle Moodle LMS=3.9.2
Frequently Asked Questions
1
Has a CVE identifier been assigned?
The report states that the vendor had not assigned a CVE at the time of disclosure. It also states that MITRE CNA-LR request CAN-2026-2032565 was under review, but this is a request identifier rather than an assigned CVE.