CVE-2026-42164 Information disclosure in n/a
An attacker can craft specific calls to retrieve backed-up content from other Text sections, leading to unauthorized data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42164?
CVE-2026-42164 is a critical vulnerability in n/a, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
Weakness: CWE-200
Which versions are affected by CVE-2026-42164?
How do I fix CVE-2026-42164?
No fix has been published for CVE-2026-42164 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-42164 being exploited?
There is no known exploitation of CVE-2026-42164 in the wild and no public exploit code.
Sources
Also known as GHSA-x7jm-3mhf-jwch.