{"id":"CVE-2026-119553","kind":"vulnerability","aliases":["CVE-2026-119553"],"related":[],"title":"Moodle: crafted Blackboard question import reads server files","description":"Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.","summary":"Moodle's Blackboard question import accepts zip files whose image paths contain ../ sequences, so a teacher can copy server files such as config.php into their own draft area. An attacker who can import questions can read server configuration, which may include database credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"moodle","fixed":[],"affected":"5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; <= 4.5.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["file-read","lms","moodle","path-traversal","php","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-untrusted-editors"],"how_to_check":"- Check the installed Moodle version in the admin dashboard or `version.php` under the Moodle root.\n- Confirm whether the installed version falls in 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, or up to 4.5.15.","fix":"unknown: no fixed release published yet; watch https://moodle.org/security/ for the MSA and upgrade each branch to its fixed release","status":"open","published_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:23+00:00","updated_at":"2026-10-30T12:33:39+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T12:32:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Moodle: crafted Blackboard question import reads server files","impact":"medium","summary":"Moodle's Blackboard question import accepts zip files whose image paths contain ../ sequences, so a teacher can copy server files such as config.php into their own draft area. An attacker who can import questions can read server configuration, which may include database credentials.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["moodle","self-hosted","php","lms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server config files readable, possibly including database credentials","analyst_note":"Sources do not give fixed versions or a patch link; check the Moodle security announcements for the fixed release per branch.","how_to_check":"- Check the installed Moodle version in the admin dashboard or `version.php` under the Moodle root.\n- Confirm whether the installed version falls in 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, or up to 4.5.15.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-editors"],"who_is_affected":"Moodle sites where teachers or others hold question import or lesson edit rights can trigger the flaw, since the import of a crafted Blackboard zip is the attack path. Sites with only trusted administrators editing content have a smaller exposure, but the sources do not say whether a default configuration limits who holds these rights. unknown for the exact default roles.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4196,"output_tokens":580,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not give fixed versions or a patch link; check the Moodle security announcements for the fixed release per branch.","search":"'-119553':11A,14A '-2026':10A,13A '4.5.15':85C '5.0.0':80C '5.0.11':82C '5.1.0':77C '5.1.8':79C '5.2.0':74C '5.2.4':76C '5.3.0':73C 'accept':34B 'area':56B,124C 'attack':58B 'blackboard':3A,31B,93C 'config.php':51B,120C 'configur':66B 'contain':40B,86C,114C 'copi':46B,116C 'craft':2A,108C 'credenti':71B 'cve':9A,12A 'databas':70B 'draft':55B,123C 'edit':103C 'file':8A,17B,36B,48B,118C 'file-read':16B 'format':96C 'host':28B 'imag':38B 'img':111C 'import':5A,33B,61B,95C,100C 'includ':69B 'lesson':102C 'like':119C 'lms':19B 'may':68B 'moodl':1A,20B,29B,72C 'moodle':15A 'path':22B,39B,88C 'path-travers':21B 'php':24B 'question':4A,32B,62B,94C,99C 'read':6A,18B,64B 'right':104C 'runtim':25B 'self':27B 'self-host':26B 'sequenc':41B,115C 'server':7A,47B,65B,117C 'src':112C 'teacher':44B,97C 'travers':23B,89C 'upload':106C 'valu':113C 'vulner':90C 'whose':37B 'zip':35B,109C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Moodle sites where Blackboard question import is available to teachers (question bank import or lesson edit). A teacher can upload a crafted zip with ../ in img src and copy files the web server user can read, such as config.php with database credentials, into their draft area. Students cannot import; sites that trust all teachers, or use managed hosting patched by the host, have lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119553","severity":null,"published_at":"2026-10-30T12:16:42+00:00","modified_at":"2026-10-30T12:16:42+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119553:1154","url":null,"severity":null,"published_at":"2026-10-30T12:33:39+00:00","modified_at":"2026-10-30T12:33:39+00:00","first_seen_at":"2026-10-30T12:33:39+00:00","fetched_at":"2026-10-30T12:33:39+00:00","note":"No Moodle MSA found yet; fixed versions unknown (VulnCheck lists through 5.3.0/5.2.4/5.1.8/5.0.11/4.5.15 as affected). Researcher Abraxas Labs published 12 Oct with lab gadget PoC (not full Moodle); fix suggested: clean_param PARAM_PATH on img src in formatbase.php text_field. Teacher-only; students 403. MDL-75237 commits are an older sibling fix, not this one. Nothing verified: no vendor page."}],"documents":[{"id":23439,"url":"https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-blackboard-import-path-traversal","title":"VulnCheck: Moodle Blackboard Import Path Traversal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23441,"url":"https://abraxaslabs.tech/research/moodle-blackboard-img","title":"Abraxas Labs: Moodle, Blackboard img src file read","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}