CVE-2026-113608 Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113608?
CVE-2026-113608 is a medium-severity vulnerability in jleyva moodle-block_configurablereports, published on 20 Oct 2026.
Official description
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.
Weakness: CWE-89
Which versions are affected by CVE-2026-113608?
How do I fix CVE-2026-113608?
No fix has been published for CVE-2026-113608 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113608 being exploited?
There is no known exploitation of CVE-2026-113608 in the wild and no public exploit code.
Sources
Also known as GHSA-7qwj-4vq5-8c2j.