Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-119553: Moodle import lets teachers copy server files

CVE-2026-119553 · published 2 days ago

Summary

In certain Moodle versions, a teacher who can import questions or edit lessons can upload a specially crafted zip file that causes the system to copy internal files, such as the configuration file, into a location they can view. This could expose sensitive information. Updating Moodle to the latest release removes the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	moodle project	moodle	5.3.0
Ubuntu:Pro:16.04:LTS	canonical	moodle	All versions

Original advisory text

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.

References

https://abraxaslabs.tech/research/moodle-blackboard-img Third Party Advisory
https://github.com/moodle/moodle/blob/v5.3.0/public/question/format/blackboard_s... Third Party Advisory
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and... Third Party Advisory
https://github.com/moodle/moodle Third Party Advisory
https://git.moodle.org URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1195... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-119553 Vendor Advisory
https://ubuntu.com/security/CVE-2026-119553 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-119553 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-23Relative Path Traversal

Timeline

Published3 Nov 2026

Updated4 Nov 2026

First seen30 Oct 2026

Sources

CVE-2026-119553 · NVD

CVE-2026-119553 · MITRE

CVE-2026-119553 · OSV

UBUNTU-CVE-2026-119553 · OSV

Track software like this

Free during beta