CVE-2026-26046 is an OS command injection vulnerability identified in Moodle's TeX filter administrative setting. The root cause is insufficient sanitization of configuration input fields used by the TeX filter, which, when enabled alongside ImageMagick installation, allows an attacker with administrative privileges to inject and execute arbitrary system commands. This vulnerability affects Moodle versions 0, 5.0.0, and 5.1.0. The TeX filter is a feature that processes LaTeX or TeX markup to generate images or mathematical expressions, often relying on ImageMagick for image processing. Because the vulnerability requires administrative privileges, exploitation is limited to trusted users or attackers who have already compromised an admin account. However, successful exploitation can lead to full server compromise, including data theft, defacement, or service disruption. The CVSS v3.1 score is 7.2, indicating high severity, with attack vector network-based, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No public exploits have been reported yet, but the vulnerability's nature and impact warrant urgent attention. The vulnerability was published on February 21, 2026, and is tracked under CVE-2026-26046.

The potential impact of CVE-2026-26046 is significant for organizations using Moodle with the TeX filter enabled and ImageMagick installed. An attacker with administrative access could execute arbitrary commands on the underlying server, leading to full system compromise. This could result in unauthorized data access or exfiltration, modification or deletion of critical educational content, disruption of learning services, and potential lateral movement within the network. Given Moodle's widespread use in educational institutions globally, the vulnerability could affect universities, schools, and training providers, potentially impacting millions of users. The requirement for administrative privileges limits the attack surface but does not eliminate risk, especially in environments with weak admin credential management or insider threats. The compromise of Moodle servers could also damage organizational reputation and lead to regulatory compliance issues related to data protection.

To mitigate CVE-2026-26046, organizations should: 1) Immediately update Moodle to a patched version once available, or apply any vendor-provided security patches or configuration workarounds. 2) Disable the TeX filter if it is not essential to reduce the attack surface. 3) Restrict administrative access to trusted personnel only, enforce strong authentication mechanisms such as multi-factor authentication, and regularly audit admin accounts for suspicious activity. 4) Limit or isolate the Moodle server's ability to execute system commands or interact with ImageMagick through OS-level controls such as AppArmor, SELinux, or containerization. 5) Monitor Moodle logs and system logs for unusual command execution or configuration changes. 6) Educate administrators on secure configuration practices and the risks of injecting untrusted input. 7) Implement network segmentation to limit the impact of a compromised Moodle server. These steps go beyond generic advice by focusing on reducing the attack vector and hardening the environment against privilege misuse.