CVE-2026-102577: Moodle

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

Affected products

• Moodle Moodle: before 4.5.13 (fixed in 4.5.13); from 5.0.0, before 5.0.9 (fixed in 5.0.9); from 5.1.0, before 5.1.6 (fixed in 5.1.6); from 5.2.0, before 5.2.2 (fixed in 5.2.2)

Published 2026-09-30. Last modified 2026-10-01.