A message published on September 29, 2026 questions a claim of upload-validation bypass and remote code execution under a misconfiguration in Moodle 3.9.2. The author asks for reproduction on a newer version.
A message published on September 29, 2026 in the oss-sec feed questions the relevance of a claim involving upload-validation bypass and remote code execution (RCE) under a misconfiguration in Moodle 3.9.2. The text does not confirm the flaw; it asks whether the behavior was reproduced on an updated version.
The message says version 3.9.2 is old and no longer receives security support. It states that the latest release in the 3.9 series was 3.9.25, released on December 8, 2023, and specifically asks whether the behavior also occurs in Moodle 4.1.22. The argument is that issuing a CVE without this confirmation could add noise to an already busy stream of CVEs and advisories.
To check the context and any replies, consult the original post in the oss-sec feed archive, compare versions, and check Moodle’s official security advisories. Since the content is an automatic translation, verify wording and details against the original before drawing conclusions. If using AI to analyze the report, do not submit internal information, credentials, or personal data; follow your organization’s policy and share only the material needed.