End of life: 10/1/2029, End of support: 10/4/2027, Latest version: 5.3.0

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.

A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.

A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.

A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.

A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

A flaw was found in Moodle. A SQL injection risk was identified in a question bank web service, allowing unsanitized input to reach a database query. The advisory does not state the exact capability required to call the affected web service function; this draft assumes it requires an elevated (teacher-level) role rather than being reachable by a basic authenticated user.

A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior.

A flaw was found in Moodle. User list filters did not respect user profile field visibility settings, allowing a manager to filter by a profile field they could not otherwise view on a user's profile, resulting in partial, inference-based information disclosure.

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

A flaw was found in Moodle. The XML grade import functionality, which allows setting or overwriting of student grades, did not include the token required to prevent a cross-site request forgery (CSRF) risk, allowing an attacker to overwrite grades on behalf of a logged-in victim who visits a malicious page.

A flaw was found in Moodle. User list filters did not respect user profile field visibility settings, allowing a manager to filter by a profile field they could not otherwise view on a user's profile, resulting in partial, inference-based information disclosure.

Hi!

greetings, Daniel

On 29/09/2026 09:42, Michael Straßberger wrote: Hello,

3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.

Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's beneficial to issue even more for software version that are way beyond EOL.

On Mon, 2026-09-28 at 22:34 +0500, Muhammad Arslan Official wrote: Hello,

I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.

Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09- 06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix. Kind Regards

Michael

A flaw was found in Moodle. Missing capability checks made it possible for a low-privileged authenticated user to trigger grade penalty recalculation without holding the capability normally required to do so.

A flaw was found in Moodle. When enrolling a user into a course while selecting a group, a check that the selected group actually belonged to that course was missing, allowing a teacher to add users to groups in courses the teacher could not otherwise access.

A flaw was found in Moodle. An incorrect capability check in the AI editor placement's "generate image" web service allowed a user to invoke that feature without holding the required capability. The advisory does not state the exact privilege level of an affected user; this draft assumes access is limited to users who already hold some content-editing role rather than a fully anonymous or lowest-privilege user.

A flaw was found in Moodle. Insufficient escaping of the username on the password reset page allowed a minor cross-site scripting (XSS) risk if an unauthenticated user was tricked into opening a crafted password reset link. The reporter states this did not affect authenticated user sessions; that disclaimer is reflected in the impact assessment here.

A flaw was found in Moodle's grade web service. An incorrect capability check allowed a student to access profile information of other students enrolled in the same course, which they would not otherwise have access to.

A flaw was found in Moodle. A SQL injection risk was identified in a question bank web service, allowing unsanitized input to reach a database query. The advisory does not state the exact capability required to call the affected web service function; this draft assumes it requires an elevated (teacher-level) role rather than being reachable by a basic authenticated user.

A flaw was found in Moodle. Insufficient escaping in templates used to display forum posts resulted in a cross-site scripting (XSS) risk, allowing a stored script to execute in the browser of another user who views the affected forum post.

A flaw was found in Moodle's report builder (corereportbuilder). Insufficient validation of the audience classname allowed arbitrary class instantiation. No exploitable gadget chain leading to a stronger impact (e.g. code execution or data disclosure) has been demonstrated; the flaw is treated here as instantiation of an arbitrary class with no confirmed further primitive.

A flaw was found in Moodle. The manual enrolment management page did not correctly observe the disabled state of the manual enrolment plugin, allowing direct access to the page when the plugin was disabled and no longer linked from the UI. The relevant enrolment capability was still required to access the page, limiting the practical impact.

A flaw was found in Moodle's URL downloader. Incorrect handling of IPv4-mapped IPv6 addresses in the host-blocking logic allows an authenticated user to bypass some blocked-host restrictions, resulting in a server-side request forgery (SSRF) risk when the downloader fetches a crafted URL. No further impact beyond partial blocklist bypass has been demonstrated.

On 9/28/26 10:34, Muhammad Arslan Official wrote: I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response. oss-security is not a CNA and cannot issue CVE IDs. Before 2017, the MITRE CNA-LR used to accept CVE requests via this mailing list, but they stopped in 2017 and redirected people to their web forms instead [1], so this has never been a way to bypass MITRE to get a CVE assignment.

[1] https://www.openwall.com/lists/oss-security/2017/02/09/7

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Hello,

3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.

Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's beneficial to issue even more for software version that are way beyond EOL.

On Mon, 2026-09-28 at 22:34 +0500, Muhammad Arslan Official wrote: Hello,

I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.

Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09- 06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix. Kind Regards

Michael

Hello,

I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response.

Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required: authenticated, Student-level account Vendor status: reported via Bugcrowd 2025-08-31, triaged P3 (2025-09-06); vendor acknowledged the behaviour but has not assigned a CVE or committed to a code fix.

Summary ------- The user profile picture upload is intended to accept images only and enforces this through multiple server- and client-side validation layers. All of these can be bypassed, allowing an authenticated Student-level user to store a non-image, server-executable file (a PHP web shell). The bypass combines a spoofed Content-Type, a non-image executable extension, a valid image magic- byte header prepended to the payload, and manipulation of the client-side acceptedtypes control.

Impact ------ The validation bypass (a code-level defect) is independent of server config. Where the Moodle data directory (moodledata) is located inside the web root - a configuration Moodle documents as forbidden but which occurs in practice - the stored file is directly reachable and executes, resulting in remote code execution in the web-server context. Even in hardened configurations, the stored payload is a durable chaining primitive for any file-inclusion flaw.

Disclosure timeline ------------------- 2025-08-31 Reported to vendor via Bugcrowd 2025-09-06 Triaged and accepted P3 by Bugcrowd 2025-11 to 2026-05 Vendor technical discussion; no fix commitment, no CVE 2026-06-27 MITRE CNA-LR request filed (CAN-2026-2032565) - still under review 2026-09 Public disclosure via this post

I am withholding the full step-by-step exploit chain and PoC here, since no patch exists, but can provide complete technical documentation (intercepted requests, reproduction steps, command-execution evidence) to coordinators or the vendor on request.

Requesting a CVE ID for this issue.

Regards, Muhammad Arslan Qureshi (unlitshadow)

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests