Vulnerability · Published Feb 21, 2026 · Assigned by fedora

CVE-2026-26046Moodle: moodle: improper input sanitization in tex filter administration setting

High 7.2

In plain English

A high-severity OS command injection in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.8% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)13.8%top 3.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.

Affected products (as reported)

Vendor	Product	Versions
	moodle	0 – before 4.5.95.0.0 – before 5.0.55.1.0 – before 5.1.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-26046 vdb-entry, x_refsource_REDHAT
RHBZ#2440903 issue-tracking, x_refsource_REDHAT