MSA-26-0002: Remote code execution risk in TeX filter admin setting

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-02-17 10:30 UTC
Importiert: 2026-06-22 12:20 UTC
CVSS: 7.2
Quelle-ID: moodle
uid_hash: 5b47240e3996472500c160f82c5792469e5bdac82b6e821fd1470fd35e690cff

Moodle Security Announcements

Inhalt

by Michael Hawkins.

Additional sanitizing was required on a TeX filter administration setting to prevent a remote code execution risk.

Note: The affected setting could only be accessed by site administrators, and only affected sites with the TeX notation filter enabled and ImageMagick installed on the server.

Severity/Risk: Serious

Versions affected: 5.1 to 5.1.1, 5.0 to 5.0.4, 4.5 to 4.5.8 and earlier unsupported versions

Versions fixed: 5.1.2, 5.0.5 and 4.5.9

Reported by: Vicevirus

CVE identifier: CVE-2026-26046

Changes (main):

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87843 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-87870

Tracker issue: MDL-87843 and MDL-87870 Remote code execution risk in TeX filter admin setting

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-26046	HIGH	7.2	HIGH	7.2			2026-02-21

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Moodle Security Announcements	moodle	vendor_advisory	cms	-	de	https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml

Zurueck zur Eintrags-Liste