https://seclists.org/oss-sec/2026/q3/974: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Affected Software
Frequently Asked Questions
Which versions are confirmed to be affected?
Moodle LMS 3.9.2 is the only version confirmed in the disclosure. Other versions have not yet been verified.
What access would an attacker need?
An attacker needs an authenticated Student-level account. The disclosed technique requires bypassing upload controls using a spoofed Content-Type, an executable extension, an image magic-byte header, and manipulation of the client-side accepted_types control.
Is remote code execution expected in every affected deployment?
No. The disclosure describes code execution as occurring under a server misconfiguration; it does not specify which configuration permits the uploaded PHP file to execute.
Is a vendor fix or CVE available?
The vendor acknowledged the reported behavior but had not assigned a CVE or committed to a code fix at the time of the disclosure. The report was submitted through Bugcrowd on 2025-08-31 and triaged as P3 on 2025-09-06.