ENISA's EUVD lists Moodle path traversal in Blackboard question import (EUVD-2026-113818)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Moodle
- Product
- Moodle
- First seen
Summary
The EUVD entry EUVD-2026-113818 reports a path traversal vulnerability in Moodle's Blackboard question import format across multiple version ranges, scored 7.1/10 (CVSS v3.1). According to the entry, teachers with question import or lesson edit permissions can exploit it.
If you use Moodle
Identify whether your Moodle site runs an affected version through 4.5.15 or 5.0–5.3.
Apply the security update from Moodle for your branch.
Limit question import and lesson edit permissions to trusted staff until patched.
Disable the External database enrolment plugin if it is not needed.
Identify whether your Moodle site runs an affected version from 4.2.0 through 5.3.0.
Review web service tokens and restrict them to required functions.
What the sources say 4
· Mastodon: “Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hi” Source
· Mastodon: “Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service.” Source
· Mastodon: “Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber.” Source
· Mastodon: “Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format.” Source