A Moodle TeX filter administrators setting accepts input that is not fully sanitized, allowing a crafted value to inject system commands. The weakness, identified as CWE‑78, means a malicious entry could be executed as the Moodle server process, potentially running arbitrary shell commands.

All Moodle installations that have the TeX filter enabled and have ImageMagick installed are at risk. The specific versions affected are not listed, so any Moodle deployment with the default TeX filtering mechanism and ImageMagick may be vulnerable.

The CVSS score of 7.2 classifies this vulnerability as high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Exploitation requires administrative privileges within the Moodle site; once achieved, the attacker can affect the entire server. The vulnerability is not yet recorded in CISA’s KEV catalog, but could become a target for attackers looking for privileged access to compromised Moodle instances.