Moodle EUVD-2026-89716

Requires an authenticated Moodle account with access to a feature that invokes the URL downloader / cURL-based remote fetch (PR:L). The attacker must supply a crafted URL expressing the restricted destination as an IPv4-mapped IPv6 address (e.g. ::ffff:<internal-ip>) so it evades the host-blocking canonicalization. Real-world impact is limited to what the Moodle server can network-reach internally (cloud metadata services, internal-only hosts); deployments where the server is network-segmented from sensitive internal endpoints see reduced impact. No user interaction is needed (UI:N), impact is confidentiality-only (C:L).

This is a genuine but modest-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) indicates a network-reachable, low-complexity flaw requiring an authenticated low-privilege account and no user interaction, with confidentiality-only impact and no scope change. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent - a real SSRF that a logged-in user can trigger, but bounded to information exposure (C:L) rather than integrity or availability loss. The practical severity of any SSRF depends heavily on what the Moodle server can reach (cloud metadata endpoints like 169.254.169.254, internal admin services), which is environment-specific and not captured by the base score; in hardened network segments the real-world impact is lower than in flat cloud deployments. Given the authenticated prerequisite, absence of exploitation evidence, and confidentiality-only rating, this is a lower-tier patch item rather than an emergency, though Moodle's enormous install base warrants routine remediation.

An attacker with a low-privileged authenticated Moodle account uses a feature that invokes the URL downloader (e.g. importing content from a remote URL) and supplies a crafted URL encoding an internal target as an IPv4-mapped IPv6 address (e.g. ::ffff:169.254.169.254). The host-blocking allowlist/blocklist fails to canonicalize the mapped form, so the server is induced to fetch the restricted internal destination and return or act on its response. No public exploit code was identified in the provided sources.