Moodle contains a flaw in the URL downloader component where IPv4-mapped IPv6 addresses are improperly handled within the host-blocking logic. This allows an authenticated user to bypass restrictions on blocked hosts by supplying specially crafted URLs. The vulnerability leads to Server-Side Request Forgery (CWE-918), enabling the server to make unauthorized requests to restricted network destinations. The CVSS 3.1 base score is 4.3, indicating medium severity. There is no information about affected versions or available patches.

An authenticated remote user can exploit this vulnerability to bypass host-blocking restrictions and induce the Moodle server to make requests to restricted network destinations. This SSRF vulnerability could potentially be used to access internal resources or services that are otherwise protected by host-blocking rules. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Moodle vendor advisories for updates. Until a fix is available, consider restricting authenticated user permissions or network-level controls to mitigate SSRF risks.