CVE-2026-102577

Published: Sep 30, 2026Modified: Oct 1, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: patrick@puiterwijk.org (Secondary)

Description

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

Affected (4)

Products: Moodle: Moodle

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	version < 4.5.13
Moodle Moodle	5.0.0 ≤ version < 5.0.9
Moodle Moodle	5.1.0 ≤ version < 5.1.6
Moodle Moodle	5.2.0 ≤ version < 5.2.2

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88779

Source: patrick@puiterwijk.org

Patch

https://access.redhat.com/security/cve/CVE-2026-102577

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2543604

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=482495

Source: patrick@puiterwijk.org

Vendor Advisory

Timeline

No history available yet.