Moodle CVE-2026-119553

Exploitation requires an authenticated account possessing the question-import capability (question bank import) or lesson-edit rights - i.e. a Teacher-level role or higher - so this cannot be triggered anonymously or by self-registered students by default. The specific trigger is uploading a crafted archive in the Blackboard question import format where img src values embed ../ path-traversal sequences; the importer then resolves these against the server filesystem and copies targeted files (e.g. config.php) into the attacker's draft file area. Limiting factors: the attacker must already hold import/lesson-edit privileges, must use the Blackboard import format path specifically, and value depends on sensitive files (config.php holds DB credentials and the site salt) being readable by the web server user. There is no user-interaction or non-default-configuration requirement beyond having the privileged role.

This is a credentialed information-disclosure flaw, not a remote-unauthenticated breach. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: network-reachable, low complexity, no user interaction, but PR:L - exploitation requires an authenticated account holding question-import or lesson-edit capability (typically a Teacher role). The high confidentiality impact (VC:H) is justified because the traversal can copy server files such as config.php, which on Moodle contains database credentials and the site secret salt, into the attacker's draft area where they can retrieve them. Integrity and availability are untouched (VI:N/VA:N), so this is a read-only exposure. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and there is no confirmation of active exploitation; the vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious-but-not-fire issue. Public research exists (abraxaslabs.tech writeup plus a VulnCheck advisory), so treat this as realistically exploitable by anyone with teacher-level access - a meaningful insider/compromised-account risk on multi-tenant or large Moodle installations - but it is gated behind privileges rather than being wormable or mass-exploitable.

A user with a Teacher role (or anyone who has compromised such an account) on a vulnerable Moodle site navigates to the question bank or lesson import feature, selects the Blackboard import format, and uploads a crafted zip whose image src attributes contain ../ traversal sequences. The parser resolves those paths against the server filesystem and copies sensitive files such as config.php into the user's draft file area, from which the attacker downloads database credentials and the site salt. A public research write-up describing the technique exists, lowering the effort required.