Live › vulnerability › CVE-2026-119553
Moodle's Blackboard question import accepts zip files whose image paths contain ../ sequences, so a teacher can copy server files such as config.php into their own draft area. An attacker who can import questions can read server configuration, which may include database credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted Moodle sites where Blackboard question import is available to teachers (question bank import or lesson edit). A teacher can upload a crafted zip with ../ in img src and copy files the web server user can read, such as config.php with database credentials, into their draft area. Students cannot import; sites that trust all teachers, or use managed hosting patched by the host, have lower exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| moodle | vendor | 5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; <= 4.5.15 | – |
version.php under the Moodle root.unknown: no fixed release published yet; watch https://moodle.org/security/ for the MSA and upgrade each branch to its fixed release
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
This page as .md · .json · in your agent: get_signal("CVE-2026-119553")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.