CVE-2016-9186

HIGH 8.8CVE-2016-9186 · Published 04/11/2016 · updated 17/06/2026

In short

CVE-2016-9186 is a HIGH (CVSS 8.8) vulnerability affecting moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 3.8%, higher than 90.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
moodle moodle	`≤ 3.1.2`	No fix yet

Description

Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

References

securityfocus.com/bid/94190 · Third Party Advisory
packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html · Exploit

More vulnerabilities in moodle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moodle

≤ 3.1.2

No fix yet

More vulnerabilities in moodle

See all →