BIT-MOODLE-2026-26047 Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service

A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade...

BIT-MOODLE-2026-26046 Moodle: moodle: improper input sanitization in tex filter administration setting

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator coul...

BIT-MOODLE-2026-26045 Moodle: moodle: improper validation in file restore functionality leading to remote code execution

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available ...

📄 Moodle TeX Formula Rendering Denial of Service

A denial of service vulnerability was identified in the TeX formula rendering component of Moodle. The issue occurs when rendering TeX content using the mimetex engine without enforcing sufficient execution time or resource limitations. By submitting specially crafted TeX formulas designed to...

ROS-20260224-73-0014

Vulnerability in moodle related to information disclosure during data transfer. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

ROS-20260224-73-0020

Vulnerability in moodle related to access control weaknesses. Exploitation of the vulnerability could allow an attacker to escalate their privileges...

ROS-20260224-73-0022

A vulnerability in the Moodle virtual learning environment is related to the failure to take measures to protect the structure of a web page. Exploitation of the vulnerability could allow a remote attacker to conduct a cross-site scripting XSS attack...

ROS-20260224-73-0015

Vulnerability in moodle related to incorrect handling of insufficient permissions or privileges. Exploitation of the vulnerability may allow an attacker to escalate privileges...

ROS-20260224-73-0016

Vulnerability in moodle related to lack of element neutralization in csv file. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260224-73-0021

Vulnerability in moodle due to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260224-73-0019

Vulnerability in moodle related to url redirection to untrusted site. Exploitation of the vulnerability could allow an attacker acting remotely to redirect a user to an arbitrary url address...

ROS-20260224-73-0017

Vulnerability in moodle due to insufficient limitation of authentication attempts. Exploitation of the vulnerability could allow a remote attacker to launch a brute force attack...

ROS-20260224-73-0023

A vulnerability in the Moodle virtual learning environment is related to improper code generation controls. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary code and compromise the system...

Linux Distros Unpatched Vulnerability : CVE-2026-26046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On...

ROS-20260224-73-0018

Vulnerability in moodle due to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-26045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was identified in Moodle's backup restore functionality where specially crafted backup files were not properly validated during processing. If a maliciou...

Linux Distros Unpatched Vulnerability : CVE-2026-26047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A denial-of-service vulnerability was identified in Moodle's TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits...

Moodle has a Remote Code Execution risk via file restore

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available ...

Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits

A Denial of Service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient execution time limits could allow specially crafted formulas to consume excessive server resources. An authenticated user could abuse this behavior to degrade...

Arbitrary Code Injection

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Arbitrary Code Injection via the backup restore process. An attacker can execute arbitrary server-side code by uploading and restoring a specially crafted backup file. This is only exploitable if th...