CVE-2026-26047

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The TeX notation filter (filter_tex) turns TeX formulas in text into images. It uses a LaTeX installation when one is configured and otherwise falls back to mimetex, a command-line renderer bundled with Moodle. The TinyMCE equation editor previews formulas through the same filters.

A Denial of Service (DoS) vulnerability (CVE-2026-26047) has been identified in the TeX notation filter of Moodle and IOMAD, which allows an authenticated user to submit specially crafted formulas whose rendering by mimetex runs without any time limit, consuming server resources and degrading or interrupting service. Moodle tracks this issue as MSA-26-0003 (MDL-86785).

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects all versions of Moodle before 4.5.9, versions 5.0.0 through 5.0.4, and versions 5.1.0 through 5.1.1, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (filter/tex)
• Affected versions: <4.5.9, >=5.0.0 <5.0.5, >=5.1.0 <5.1.2
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.9, 5.0.5, 5.1.2
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.9, 5.0.0 through 5.0.4, and 5.1.0 through 5.1.1 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

When the filter finds a formula, it stores the expression in the cache_filters table and emits an image that points at filter/tex/pix.php. The first request for that image renders it. If LaTeX rendering is not available or fails, pix.php builds a mimetex command line and runs it with PHP's system():

} else {
    // failing that, use mimetex
    $texexp = $texcache->rawtext;
    $texexp = str_replace('&lt;', '<', $texexp);
    $texexp = str_replace('&gt;', '>', $texexp);
    $texexp = preg_replace('!\r\n?!', ' ', $texexp);
    $texexp = '\Large '.$texexp;
    $cmd = filter_tex_get_cmd($pathname, $texexp);
    system($cmd, $status);
}

system() waits for the command to finish, and nothing limited how long mimetex could run. A formula crafted to make mimetex work for a long time keeps both the renderer process and the PHP worker that started it busy. Requests for several such images, or repeated requests, can use up CPU and web server workers and slow down or interrupt the site for everyone. The debugging script texdebug.php ran mimetex the same way.

The formula text comes from content that the filter processes, so any authenticated user who can get TeX in front of the filter can trigger rendering, for example by previewing an equation in the TinyMCE equation editor, which sends the formula to a web service that applies the filters in a context the user can access. Only sites where the TeX notation filter is enabled are exposed. Because pix.php falls back to mimetex whenever LaTeX rendering fails, sites with a LaTeX installation configured can still reach this code path.

The fix replaces the system() calls in pix.php and texdebug.php with a new filter_tex_exec() function in filter/tex/lib.php. It starts mimetex with proc_open(), polls it, and kills it once it exceeds FILTER_TEX_MIMETEX_TIMEOUT, which defaults to 5 seconds. On Unix-like systems the loop looks like this, and Windows uses taskkill instead of proc_terminate():

$timeoutmicros -= (microtime(true) - $start) * 1000000;
if ($timeoutmicros <= 0) {
    $timedout = true;
    proc_terminate($process);
    break;
}

A run that times out returns exit code 124, so the image is not created and the worker is released.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites that do not need TeX formulas can disable the TeX notation filter.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.9, 5.0.5, 5.1.2, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Aleksey Solovev from Positive Technologies (finder)