Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Summary by Cyber Security News29 Sep 2026, 09:48 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/979

Posted by Michael Straßberger on Sep 29 Hello, 3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

Citrix Patches Critical Zero Days Under Active Exploitation

Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772

2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day