CVE-2026-26046

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The TeX notation filter (filter_tex) turns TeX formulas in course content into images. When LaTeX and ImageMagick are installed on the server, it renders each formula by running the latex, dvips, and convert programs as shell commands.

A Remote Code Execution (RCE) vulnerability (CVE-2026-26046) has been identified in the TeX notation filter of Moodle and IOMAD, which allows a site administrator to run arbitrary operating system commands on the server by saving a crafted value in the filter's background colour setting. Only sites with the TeX notation filter enabled and ImageMagick installed are affected. Moodle tracks this issue as MSA-26-0002 (MDL-87870, MDL-87843).

Per OWASP: Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application.

This issue affects all versions of Moodle before 4.5.9, versions 5.0.0 through 5.0.4, and versions 5.1.0 through 5.1.1, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (filter/tex, lib/adminlib.php)
• Affected versions: <4.5.9, >=5.0.0 <5.0.5, >=5.1.0 <5.1.2
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.9, 5.0.5, 5.1.2
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.9, 5.0.0 through 5.0.4, and 5.1.0 through 5.1.1 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

The filter's LaTeX background colour setting (filter_tex/latexbackground) was a plain text field. filter/tex/settings.php registered it with admin_setting_configtext and no validation, so any string an administrator typed was saved as is:

$items[] = new admin_setting_configtext('filter_tex/latexbackground', get_string('backgroundcolour', 'admin'), '', '#FFFFFF');

When a formula image is not yet cached, filter/tex/pix.php reads that setting and passes it to latex::render() in filter/tex/latex.php. For PNG and GIF output, render() placed the value inside double quotes in the ImageMagick convert command line, which latex::execute() then runs with PHP's exec():

if ($background) {
    $bg_opt = "-transparent \"$background\""; // Makes transparent background
} else {
    $bg_opt = "";
}
if ($convertformat == 'svg') {
    $pathdvisvgm = escapeshellarg(trim(get_config('filter_tex', 'pathdvisvgm'), " '\""));
    $command = "$pathdvisvgm -E $ps -o $img";
} else {
    $pathconvert = escapeshellarg(trim(get_config('filter_tex', 'pathconvert'), " '\""));
    $command = "$pathconvert -density $density -trim $bg_opt $ps $img";
}

Every other argument in that command is passed through escapeshellarg(), but the background value is not. Double quotes do not stop the shell from expanding $(...) or backticks, and a value containing a double quote can close the quoted string and append further commands. A background value with shell syntax in it therefore runs extra commands as the web server user the next time the filter renders a formula.

Only a site administrator can change the setting, so the attacker needs an administrator account. Moodle still treats administrator access as separate from shell access to the server, and this flaw closes that gap: a malicious administrator, or anyone who takes over an administrator account, can run commands on the server and reach its files, the Moodle database credentials in config.php, and other sites hosted alongside it. Sites that do not have the TeX notation filter enabled, and sites without ImageMagick, are not exposed. Sites that render formulas as SVG do not use the background value in the command.

The fix has three parts. latex::render() now escapes the background value like every other argument:

$bg_opt = '-transparent ' . escapeshellarg($background); // Makes transparent background

The setting is switched to admin_setting_configcolourpicker, which only accepts colour values. The third change tightens admin_setting_configcolourpicker::validate() in lib/adminlib.php. Its rgb(), rgba(), hsl(), and hsla() patterns were not anchored, so a value was accepted if it merely contained a colour, such as a shell command followed by rgb(1, 2, 3). The patterns now match the whole value. This hardens every colour picker setting in Moodle, not only the TeX one:

} else if (preg_match('/^rgb\(\d{0,3}%?\, ?\d{0,3}%?, ?\d{0,3}%?\)$/i', $data)) {
    return $data;
} else if (preg_match('/^rgba\(\d{0,3}%?\, ?\d{0,3}%?, ?\d{0,3}%?\, ?\d(\.\d)?\)$/i', $data)) {
    return $data;
} else if (preg_match('/^hsl\(\d{0,3}\, ?\d{0,3}%, ?\d{0,3}%\)$/i', $data)) {
    return $data;
} else if (preg_match('/^hsla\(\d{0,3}\, ?\d{0,3}%, ?\d{0,3}%\, ?\d(\.\d)?\)$/i', $data)) {
    return $data;

Upstream applied the same colour picker change to the Algebra notation filter's settings, a file that Moodle 4.3 does not have.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites can disable the TeX notation filter, or confirm that the LaTeX background colour setting holds only a plain colour value such as #FFFFFF and limit who holds site administrator accounts.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.9, 5.0.5, 5.1.2, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Vicevirus (finder)