CVE-2026-26046: 
NixOS vulnerability analysis and mitigation

CVE-2026-26046 is an OS command injection vulnerability in Moodle's TeX filter administrative configuration, caused by insufficient sanitization of input parameters processed by external utilities such as ImageMagick. It affects Moodle versions before 4.5.9, 5.0.0–5.0.x before 5.0.5, and 5.1.0–5.1.x before 5.1.2, on sites where the TeX notation filter is enabled and ImageMagick is installed. The vulnerability was disclosed on February 19, 2026, with NVD publication on February 21, 2026. It carries a CVSS v3.1 base score of 7.2 (High), requiring high privileges (administrator-level) for exploitation (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). When the TeX filter is enabled and ImageMagick is installed, Moodle fails to adequately sanitize administrator-supplied configuration values before passing them to external system utilities. A malicious or compromised administrator can craft a configuration value in the TeX filter settings that injects arbitrary OS commands, which are then executed by the web server process. Exploitation requires network access and administrative privileges, but no user interaction beyond the administrator entering the malicious value (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows full compromise of the Moodle server, with arbitrary OS commands executing under the privileges of the web server process. This can result in unauthorized access to all data stored on the Moodle instance (confidentiality impact), modification or deletion of data and course content (integrity impact), and service disruption (availability impact). The entire Moodle installation and potentially the underlying host system are at risk, including student and faculty data, credentials, and any other information accessible to the web server account (Red Hat Bugzilla, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.124%, reflecting a low probability of near-term exploitation. Exploitation requires administrative privileges on the Moodle instance, significantly limiting the attack surface. The vulnerability has been detected by Nessus (plugin ID 299835) and is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE, Tenable Nessus).

1. Reconnaissance: Identify Moodle instances with the TeX notation filter enabled and ImageMagick installed. This can be done by reviewing site configuration or probing for TeX rendering functionality in course content.
2. Obtain Administrative Access: Gain access to a Moodle administrator account, either through credential theft, phishing, or privilege escalation from a lower-privileged account.
3. Navigate to TeX Filter Settings: Log in as administrator and navigate to the TeX filter administrative configuration panel (typically under Site Administration > Plugins > Filters > TeX notation).
4. Inject Malicious Command: Enter a crafted configuration value in the relevant setting field that includes OS command injection syntax (e.g., using shell metacharacters such as ;, |, or backticks) designed to be passed unsanitized to ImageMagick or another external utility.
5. Trigger Execution: Save the configuration or trigger an action that causes Moodle to invoke the external utility with the malicious parameter, resulting in arbitrary OS command execution under the web server process privileges.
6. Achieve Objective: Use the command execution to establish persistence, exfiltrate data, or further compromise the host system (Red Hat Bugzilla, Red Hat CVE).

• Logs: Moodle admin audit logs showing unexpected changes to TeX filter configuration settings; web server access logs with unusual POST requests to Moodle admin filter configuration endpoints.
• Process: Unexpected child processes spawned by the web server process (e.g., bash, sh, curl, wget, python) following TeX filter configuration changes; unusual ImageMagick (convert) invocations with anomalous arguments.
• File System: New or modified files in the Moodle data directory or web root not associated with normal Moodle operations; presence of web shells or unauthorized scripts.
• Network: Outbound connections from the web server to unknown external IPs or domains, particularly following administrator activity in the TeX filter settings.

Moodle has released patched versions addressing this vulnerability: upgrade to Moodle 4.5.9, 5.0.5, or 5.1.2 or later. As an immediate workaround, administrators should disable the TeX notation filter if it is not actively required. Restricting Moodle administrative access to trusted personnel only and implementing the principle of least privilege for the web server process will reduce the risk of exploitation. Monitoring administrative configuration changes and reviewing audit logs for unexpected TeX filter modifications is also recommended (Red Hat Bugzilla, Red Hat CVE).