CVE-2021-40694: Moodle

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.

Affected products

• Moodle Moodle: before 3.9.10 (fixed in 3.9.10); from 3.10.0, before 3.10.7 (fixed in 3.10.7); from 3.11.0, before 3.11.3 (fixed in 3.11.3)

Published 2022-09-29. Last modified 2026-06-17.