CVE-2026-26045

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
—	—	< 4.5.9; >= 5.0.0, < 5.0.5; >= 5.1.0, < 5.1.2

References

https://access.redhat.com/security/cve/CVE-2026-26045Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2440901Third Party Advisory

Timeline

Published: Feb 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-260467.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow c CVE-2026-260476.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient exec CVE-2026-260487.5The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentica CVE-2026-260495.7The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to a CVE-2026-26055.3Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.CVE-2026-260508.4The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to CVE-2026-260519.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-260525.4Insecure inherited permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalatio CVE-2026-260535.3An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privile CVE-2026-260546.8SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using CVE-2026-260557.5Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Cont CVE-2026-260568.8Yoke is a Helm-inspired infrastructure-as-code (IaC) package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Cont