CVE-2026-102577

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making unauthorized requests to internal or external resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.