Server-Side Request Forgery in Moodle due to Vulnerability in URL Downloader
CVE-2026-102577

4.3MEDIUM

Key Information:

Status
Vendor
CVE Published:
30 September 2026

What is CVE-2026-102577?

A flaw in Moodle's URL downloader allows authenticated attackers to bypass host-blocking restrictions through incorrect handling of IPv4-mapped IPv6 addresses. By crafting specific URLs, these attackers can induce the server to initiate requests to restricted destinations, potentially exposing sensitive information and creating pathways for further exploitation.

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=...
https://access.redhat.com/security/cve/CVE-2026-102577
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2543604
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Kaique Costa as the original reporter.
.