Skip to content
OpenAdvisories
High · 7.2 CVE-2026-26046 EUVD-2026-7389GHSA-4g4j-v56v-2w79

Moodle: moodle: improper input sanitization in tex filter administration setting

Published Feb 21, 2026 · Updated Feb 26, 2026 · Assigned by fedora

Description

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

Affected products

VendorProductAffectedFixed
— moodle < 4.5.9, 5.0.0 – < 5.0.5, 5.1.0 – < 5.1.2 4.5.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS moodle No fix yet —
Ubuntu Pro 16.04 LTS moodle No fix yet —

Advisories 1

References