CVE-2026-119553— Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

Quick assessment

Affected

Moodle Project moodle

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Moodle 5.3.0、5.2.0 至 5.2.4、5.1.0 至 5.1.8、5.0.0 至 5.0.11 以及 4.5.15 及更早版本中，Blackboard 题目导入格式存在路径遍历漏洞。拥有题目导入或课程编辑权限的教师可上传一个特制的 ZIP 文件，其中包含带有 "../" 序列的 img src 属性值，从而将服务器文件（如 config.php）复制到其草稿区域。

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1565.001 · Stored Data Manipulation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

Source: CVE Program / CVE List V5

Vulnerability Description

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

相对路径遍历

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Moodle Project	moodle	5.3.0	-

II. Public POCs for CVE-2026-119553

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119553

请登录查看更多情报信息。

Other References for CVE-2026-119553 (4)

https://github.com/moodle/moodle/blob/v5.3.0/public/question/format/blackboard_six/formatbase.php#L128-L133 technical-description
https://abraxaslabs.tech/research/moodle-blackboard-img third-party-advisory
https://github.com/moodle/moodle product
https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-blackboard-import-path-traversal third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119553

Same Patch Batch · Moodle Project · 2026-10-30 · 4 CVEs total

CVE-2026-119554	5.9 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Cou
CVE-2026-119555	4.3 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grad
CVE-2026-119556	4.3 MEDIUM	Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grade

IV. Related Vulnerabilities

Same product: moodle

Same vendor: Moodle Project

Same weakness: CWE-23