This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-102581 →

UBUNTU-CVE-2026-102581

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerab...

Original description

The description as published by the source.

A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:16.04:LTS moodle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS moodle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report git.moodle.org
report access.redhat.com
report bugzilla.redhat.com
report moodle.org