CVE-2026-26046

Katalog CVE

CVSS 7.2 · High EPSS 3,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada moodle. Skor CVSS 3.1 7.2 (High) menurut puiterwijk.org.

Deskripsi (NVD)

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber puiterwijk.org
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-26046 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2440903 advisory pihak ketiga