Hi!
greetings, Daniel
On 29/09/2026 09:42, Michael Straßberger wrote: Hello,
3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.
Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's beneficial to issue even more for software version that are way beyond EOL.
On Mon, 2026-09-28 at 22:34 +0500, Muhammad Arslan Official wrote: Hello,
I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.
Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09- 06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix. Kind Regards
Michael
On 9/28/26 10:34, Muhammad Arslan Official wrote: I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response. oss-security is not a CNA and cannot issue CVE IDs. Before 2017, the MITRE CNA-LR used to accept CVE requests via this mailing list, but they stopped in 2017 and redirected people to their web forms instead [1], so this has never been a way to bypass MITRE to get a CVE assignment.
[1] https://www.openwall.com/lists/oss-security/2017/02/09/7
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Hello,
3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.
Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's beneficial to issue even more for software version that are way beyond EOL.
On Mon, 2026-09-28 at 22:34 +0500, Muhammad Arslan Official wrote: Hello,
I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.
Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09- 06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix. Kind Regards
Michael
Hello,
I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.
Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09-06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix.
Summary ------- The user profile picture upload is intended to accept images only and enforces this through multiple server- and client-side validation layers. All of these can be bypassed, allowing an authenticated Student-level user to store a non-image, server-executable file (a PHP web shell). The bypass combines a spoofed Content-Type, a non-image executable extension, a valid image magic- byte header prepended to the payload, and manipulation of the client-side acceptedtypes control.
Impact ------ The validation bypass (a code-level defect) is independent of server config. Where the Moodle data directory (moodledata) is located inside the web root - a configuration Moodle documents as forbidden but which occurs in practice - the stored file is directly reachable and executes, resulting in remote code execution in the web-server context. Even in hardened configurations, the stored payload is a durable chaining primitive for any file-inclusion flaw.
Disclosure timeline ------------------- 2025-08-31 Reported to vendor via Bugcrowd 2025-09-06 Triaged and accepted P3 by Bugcrowd 2025-11 to 2026-05 Vendor technical discussion; no fix commitment, no CVE 2026-06-27 MITRE CNA-LR request filed (CAN-2026-2032565) - still under review 2026-09 Public disclosure via this post
I am withholding the full step-by-step exploit chain and PoC here, since no patch exists, but can provide complete technical documentation (intercepted requests, reproduction steps, command-execution evidence) to coordinators or the vendor on request.
Requesting a CVE ID for this issue.
Regards, Muhammad Arslan Qureshi (unlitshadow)
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users' browsers and steal session cookies.
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.