https://seclists.org/oss-sec/2026/q3/979: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Published Sep 29, 2026
·Updated
Affected Software
1 affected component
Moodle Moodle LMS=3.9.2
Frequently Asked Questions
1
Which Moodle versions have been confirmed affected?
Only Moodle LMS 3.9.2 is identified as confirmed. Other versions, including Moodle 4.1.22, had not been verified as of the discussion.
2
What level of access would an attacker need?
The report states that exploitation requires an authenticated Student-level account. No unauthenticated attack path is described.
3
Is the affected release still supported?
Moodle LMS 3.9 is stated to be out of security support. The discussion notes that 3.9.25, released on 8 December 2023, was the latest release in that minor branch.