CVE-2026-113683 in Virtual Programming Lab
Summary
by MITRE • 10/20/2026
VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within the Virtual Programming Lab (VPL) plugin for Moodle prior to version 5.0.0 represents a classic instance of reflected cross-site scripting, technically classified under CWE-79 in the Common Weakness Enumeration framework. This flaw resides specifically within the similarity/diff.php script component, which is responsible for generating and displaying code differences or similarities between student submissions. The root cause stems from inadequate input validation and sanitization mechanisms applied to the filename1 and filename2 parameters passed via HTTP GET requests. When these parameters are processed by the application logic, they are rendered directly into the HTML output without proper encoding of special characters such as angle brackets, quotes, and ampersands. This failure allows an attacker to inject arbitrary JavaScript code that is executed in the context of the victim's browser session upon rendering the page.
From a technical perspective, this vulnerability exploits the lack of contextual escaping when user-supplied data is embedded into HTML content. The similarity/diff.php endpoint accepts filenames as query parameters and uses them to locate specific files for comparison. However, instead of treating these inputs strictly as file paths or identifiers that require strict whitelisting or canonicalization, the application treats them as safe strings until they are outputted. Consequently, if an attacker crafts a URL where filename1 or filename2 contains malicious script tags, such as <script>alert(document.cookie)</script>, this payload is reflected back in the HTTP response and executed by any user who views the page. This mechanism aligns with MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers, specifically leveraging client-side code injection to achieve malicious objectives.
The operational impact of this vulnerability is significant due to its potential for session hijacking and unauthorized actions on behalf of the victim. Since the exploit requires a user with the mod/vpl:similarity permission to open the crafted link, it targets students or instructors who have access to view submission similarities. Once executed, the injected script can perform various malicious activities depending on the attacker's intent. These include stealing session cookies and authentication tokens, which could lead to full account compromise if combined with other attacks like network sniffing or man-in-the-middle techniques. Additionally, the payload could be used to deface the user interface, redirect users to phishing sites designed to harvest credentials, or perform unwanted actions within the Moodle platform such as submitting assignments or modifying settings without authorization. The reliance on social engineering through a crafted link means that successful exploitation depends heavily on convincing a privileged user to click the malicious URL, often disguised as a legitimate similarity check request.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the VPL plugin to version 5.0.0 or later, where this input validation flaw has been corrected by implementing proper output encoding for all user-supplied parameters before they are rendered in HTML context. For organizations unable to patch immediately due to compatibility constraints, temporary mitigations include restricting access to the similarity/diff.php endpoint through web application firewall rules that detect and block common XSS payloads within URL parameters. Furthermore, administrators should enforce strict Content Security Policy headers on Moodle instances to limit the execution of inline scripts and restrict data exfiltration channels. Regular security audits focusing on input validation patterns across all custom plugins are essential to prevent similar reflection-based injection flaws from persisting in educational software ecosystems.