CVE-2026-26045: Moodle Remote Code Execution Risk via File Restore
Summary
CVE-2026-26045: Moodle has a Remote Code Execution risk via file restore. Affects moodle/moodle across 3 version ranges.
< 4.5.9
>= 5.0.0-beta, < 5.0.5
>= 5.1.0-beta, < 5.1.2
Fixed in 4.5.9, 5.0.5 or 5.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2026-26045 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various functionalities such as course management, user enrollment, and content delivery. However, a critical vulnerability has been identified in its backup restore functionality, which could allow unauthorized execution of server-side code if exploited.
Vulnerability Detail
A flaw exists in Moodle's backup restore functionality where specially crafted backup files are not adequately validated during processing. This vulnerability allows an attacker with authenticated access to restore a malicious backup file, potentially leading to remote code execution on the server. The implications of this vulnerability are severe, as successful exploitation could result in a complete compromise of the Moodle server, allowing attackers to manipulate data, access sensitive information, and disrupt services.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.94.5.9composer require moodle/moodle:4.5.9 -
>= 5.0.0-beta, < 5.0.55.0.5composer require moodle/moodle:5.0.5 -
>= 5.1.0-beta, < 5.1.25.1.2composer require moodle/moodle:5.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the backup restore functionality to only trusted and necessary users. This can be done by reviewing user permissions and ensuring that only privileged users have the ability to restore backups.
Conclusion
The vulnerability identified as CVE-2026-26045 poses a significant risk to Moodle installations, allowing for potential remote code execution through malicious backup files. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their Moodle environments.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2026-26045 is a vulnerability in Moodle that allows for remote code execution through improperly validated backup files during the restore process.
Any Moodle installation running versions prior to the patched versions (5.1.2, 5.0.5, or 4.5.9) is at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to full server compromise, allowing attackers to execute arbitrary code, access sensitive data, and disrupt Moodle services.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
