https://seclists.org/oss-sec/2026/q3/1016: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Published Sep 30, 2026
·Updated
Affected Software
1 affected component
Moodle Moodle LMS=3.9.2
Frequently Asked Questions
1
Which deployments are confirmed to be affected?
Only Moodle LMS 3.9.2 is confirmed. Other versions, including Moodle 4.1.22, were not verified in the disclosure.
2
What level of access does an attacker need?
The reported issue requires an authenticated Moodle account with Student-level privileges. No unauthenticated attack path is described.
3
Is the affected release still supported?
No. Moodle 3.9 no longer has security support; the latest release in that minor branch was 3.9.25, dated 8 December 2023.