Path Traversal Vulnerability in Moodle by Moodle
CVE-2026-119553

7.1HIGH

Key Information:

Vendor

Moodle Project

Status
Moodle
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119553?

A path traversal vulnerability exists in Moodle, specifically within the Blackboard question import format. This flaw affects multiple versions of Moodle, allowing users with question import or lesson edit rights to upload specially crafted zip files that can exploit the ../ sequence. By leveraging this vulnerability, it becomes possible to access restricted files on the server, including sensitive configuration files like config.php, thereby compromising the integrity and security of the application.

Affected Version(s)

moodle 5.3.0

moodle 5.2.0 <= 5.2.4

moodle 5.1.0 <= 5.1.8

References

https://github.com/moodle/moodle/blob/v5.3.0/public/quest...
technical-description
https://abraxaslabs.tech/research/moodle-blackboard-img
third-party-advisory
https://github.com/moodle/moodle
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.