CVE-2009-1171: The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allow...

Security readout for executives and security teams

Older Moodle sites can expose sensitive server files through the TeX math filter. If an attacker can get malicious TeX-style content processed, Moodle may include file contents in rendered output. This can expose configuration, credentials, or local data depending on server permissions. Exposure is mainly legacy Moodle deployments that still run the listed 1.x versions with the TeX filter enabled and reachable by users who can submit content rendered by that filter. Prioritize remediation for any internet-facing or student-facing legacy Moodle instance. The issue is old, but public exploit material and possible sensitive file disclosure make unpatched systems a meaningful exposure. Mitigation focus: Upgrade Moodle to the fixed branch version or a supported current release.; Disable the TeX filter until patching is complete, if operationally acceptable.; Limit content submission privileges on affected Moodle sites..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.