CVE-2026-113683 jcrodriguez-dis CVE debrief

Who should care

Moodle administrators and users with mod/vpl:similarity permissions should assess exposure and apply patches or workarounds to prevent exploitation. Defenders should care about CVE-2026-113683 because it allows attackers to inject malicious scripts into user sessions, potentially leading to unauthorized actions or data disclosure. The vulnerability requires verification of Moodle VPL version and application of patches or workarounds.

Why it matters

Defenders should care about CVE-2026-113683 because it allows attackers to inject malicious scripts into user sessions, potentially leading to unauthorized actions or data disclosure. Moodle administrators and users with mod/vpl:similarity permissions should assess exposure and apply patches or workarounds to prevent exploitation. The vulnerability requires verification of Moodle VPL version and application of patches or workarounds. Evidence is based on official CVE Program and NVD records, as well as developer references.

• User session hijacking and data disclosure
• Unauthorized actions under user session
• Potential for phishing and social engineering attacks

Technical summary

The vulnerability exists in the similarity/diff.php file of VPL for Moodle before version 5.0.0. An attacker can inject malicious scripts via unencoded filename parameters, which execute when a user with mod/vpl:similarity permissions opens a crafted link. This allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. The vulnerability requires verification of Moodle VPL version and application of patches or workarounds to prevent exploitation. Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent exploitation.

Recommended defensive actions

• Verify Moodle VPL version and apply patch or workaround if necessary
• Restrict access to similarity/diff.php
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in VPL for Moodle versions before 5.0.0. The CVE Program and NVD provide official records of this vulnerability. Evidence is based on official CVE Program and NVD records, as well as developer references. Defenders should verify Moodle VPL version and apply patches or workarounds to prevent exploitation. The vulnerability requires verification of Moodle VPL version and application of patches or workarounds.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.