NVD security advisory
Security advisory for Moodle 5.3.0, 5.2.0
CVE-2026-119553
Full advisory details, affected packages, severity context, and original source.
Affected technology
Moodle 5.3.0, 5.2.0Affected product
Advisory overview
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Related references
- https://abraxaslabs.tech/research/moodle-blackboard-img
- https://github.com/moodle/moodle
- https://github.com/moodle/moodle/blob/v5.3.0/public/question/format/blackboard_six/formatbase.php#L128-L133
- https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-blackboard-import-path-traversal