CVE-2026-113702 · Other
NO FIX YET · SEE WHAT TO DO
iomad, a Moodle-based learning platform, has an authorization bypass in the PDF certificate handler's pluginfile function (local_iomad_pluginfile in public/local/iomad/lib.php). A remote attacker can use it to access files they should not be able to reach.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running iomad, the Moodle-based learning platform, in the affected version ranges with the PDF certificate handler plugin in use. The flaw sits in the file-serving path for certificates, so sites that do not use the certificate feature are less exposed; the sources do not say more.
Not affected if iomad-version-outside-ranges
Who cares iomad, lms, moodle, self-hosted
4.5.15, 5.0.11, 5.1.8 and 5.2.4public/local/iomad/lib.php in the Moodle install and confirm whether local_iomad_pluginfile matches the patched codeA security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.