VPL for Moodle CVE-2026-113683

Exploitation requires a victim user who holds the mod/vpl:similarity capability (normally a teacher or grader reviewing VPL submission similarity) to open an attacker-crafted similarity/diff.php link whose filename1/filename2 parameters carry a JavaScript payload; the flaw exists because $filename was concatenated into the HTML header without encoding (fixed via s() in V5.0.0). This affects default configurations of moodle-mod_vpl before 5.0.0 - no special server-side setting is needed. Exploitation is LIMITED by mandatory user interaction (the privileged user must click the link, UI:A) and by the requirement that the victim already be authenticated with the similarity capability; impact is confined to that user's session rather than the server, and patched installations (>=5.0.0) are not affected.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 base score of 5.1 (Medium) reflects reflected XSS: the input vector states AV:N/AC:L/PR:N but UI:A (active user interaction required), with only subsequent-system low confidentiality/integrity impact (SC:L/SI:L) and no vulnerable-system impact - consistent with script execution confined to the victim's authenticated session rather than server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation signals are weak: this maps to 'no public exploit identified at time of analysis.' The practical risk is bounded by two facts - the attacker must socially engineer a user who already holds the mod/vpl:similarity capability (typically a teacher/grader) into clicking a crafted link, and the payload runs only in that user's browser context. There is no signal conflict here; all signals consistently point to a targeted, interaction-dependent, medium-risk flaw rather than a wormable or mass-exploitable one. Key missing data: EPSS probability and independent exploit confirmation are absent, so real-world exploitation likelihood cannot be quantified beyond 'low/unknown.' The reporting by VulnCheck and the confirmed vendor patch raise confidence that the vulnerability itself is real.

An attacker crafts a similarity/diff.php URL with a JavaScript payload embedded in the unencoded filename1/filename2 parameters and sends it to a Moodle instructor or grader. When that privileged user (holding mod/vpl:similarity) opens the link, the reflected payload executes in their session, letting the attacker perform actions or exfiltrate data under their identity. No public exploit code was identified in the provided data, though the patch diff publicly reveals the exact unescaped sink.