PT-2026-133491

CVE-2026-119553

·

Published

2026-10-30

·

Updated

2026-10-30

Description by

CVSS 3.1
6.5
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-23: Relative Path Traversal
Related identifiers
CVE-2026-119553
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com