CVE-2026-119553 in Moodle
Summary
by MITRE • 10/30/2026
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Blackboard question import functionality of Moodle versions 5.3.0, as well as all prior releases in the 5.2.x through 4.5.x series up to version 4.5.15. This vulnerability is classified as a path traversal issue, specifically falling under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical deficiency lies in the insufficient validation and sanitization of file paths contained within imported archive files during the parsing process for Blackboard question formats. When an administrator or teacher with specific privileges attempts to import questions via this format, the system processes zip archives that may contain image tags with source attributes pointing to external resources.
The operational mechanism of exploitation involves crafting a malicious zip file where the img src values are manipulated to include directory traversal sequences such as ../. By carefully constructing these paths, an attacker can direct the server to read files from locations outside the intended web root or user-specific directories. In this specific instance, the vulnerability allows for the copying of sensitive configuration files, most notably config.php which contains database credentials and other critical system settings, into a draft area accessible by the authenticated user. This bypasses standard access controls because the import function treats the content as part of the question data structure rather than validating its origin or destination path integrity against directory boundaries.
The impact of this vulnerability is significant for institutions relying on Moodle for educational delivery and assessment management. An attacker with teacher-level privileges, which are common in many organizational setups to facilitate course creation and grading, can exploit this flaw to exfiltrate sensitive server-side configuration data. The exposure of config.php provides the database password, host information, and potentially other secrets required to gain deeper access to the underlying infrastructure. This initial foothold can serve as a stepping stone for further attacks, including full system compromise if combined with other vulnerabilities or weak administrative credentials. It also violates the principle of least privilege by allowing lower-level users to access high-sensitivity configuration files that should remain restricted to server administrators only.
From an industry standard perspective, this vulnerability aligns with MITRE ATT&CK technique T1530: Data from Cloud Storage Object, as it involves reading data stored on the system outside of normal application boundaries. It also reflects CWE-284: Improper Access Control in conjunction with CWE-22, highlighting a failure to enforce proper access controls during file operations. The vulnerability underscores the risks associated with complex import parsers that handle user-supplied content without rigorous path canonicalization and validation checks against allowed directories.
To mitigate this risk, organizations must immediately upgrade Moodle to version 5.3.1 or later, where these specific parsing logic flaws have been addressed by implementing stricter input validation for file paths within the Blackboard import module. Until an upgrade is feasible, administrators should restrict question import capabilities to only those users who absolutely require them and monitor audit logs for unusual file access patterns related to draft areas. Additionally, ensuring that web server configurations prevent direct execution or viewing of files in user upload directories can provide a layer of defense-in-depth, although the primary remediation remains patching the application code to enforce proper path sanitization during archive extraction processes.