CVE-2026-26046

high · 7.2

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

7.2

CVSS

13.8%

EPSS (exploit prob.)

96th

EPSS percentile

2026-02-21

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
moodle	moodle	< 4.5.9
moodle	moodle	>= 5.0.0, < 5.0.5
moodle	moodle	>= 5.1.0, < 5.1.2

Check a specific version with /api/v1/cve/match.

References

https://access.redhat.com/security/cve/CVE-2026-26046
https://bugzilla.redhat.com/show_bug.cgi?id=2440903

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-26046