A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 21, 2026 · NIST NVD

   Detected

   A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result i

2. Jun 17, 2026 · NIST NVD

   Updated

   A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result i

Affected

• cpe moodle/moodleversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-26045

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-26045

  A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typ

  nvd.nist.gov

References

• Third Party Advisory · access.redhat.com
• Third Party Advisory · bugzilla.redhat.com