CVE-2026-26045

Katalog CVE

CVSS 7.2 · High EPSS 0,78%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada moodle. Skor CVSS 3.1 7.2 (High) menurut puiterwijk.org.

Deskripsi (NVD)

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber puiterwijk.org
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-26045 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2440901 advisory pihak ketiga