CVE-2021-21809

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

8.2 HighPublic exploitFix available

A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: Low

Exploit likelihood

24.2%Up 23.4 points since Jun 24, 2021

What each source reports

CVE List Score used 8.2

Record: CVE-2021-21809
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Updated: 2026-11-02

EUVDEUVD-2022-3528 8.2

Record: EUVD-2022-3528
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c7jj-vfmr-j9mj 9.1

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

Record: GHSA-c7jj-vfmr-j9mj
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-732
Updated: 2026-11-02

NVD 9.1

Record: CVE-2021-21809
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.1

Record: CVE-2021-21809
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-c7jj-vfmr-j9mj 9.1

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

Record: GHSA-c7jj-vfmr-j9mj
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-732
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-21809 9.1

Record: UBUNTU-CVE-2021-21809
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 3.0: 8.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
Updated: 2026-11-02

OSVBIT-moodle-2021-21809 No score

Record: BIT-moodle-2021-21809
Updated: 2026-11-02

Affected products

moodle

Affected packages

Affected packages
Package	Affected	Fixed
`moodle/moodle` Packagist	3.10.0 to 3.10.0	None known
`moodle/moodle` Packagist	3.11.2 to 3.11.2	None known
`moodle/moodle` Packagist	3.8.0 to 3.8.0	None known
`moodle` Bitnami	3.10.0 up to 3.10.1	3.10.1
`moodle/moodle` Packagist	Listed versions 3.10.0	None known
`moodle/moodle` Packagist	Listed versions 3.11.2	None known
`moodle/moodle` Packagist	Listed versions 3.8.0	None known
`moodle` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known
`moodle` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Moodle SpellChecker Path Authenticated Remote Command Execution	2021-06-22
PoC in GitHub	anldori/CVE-2021-21809	2022-12-20

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21809 is a high vulnerability (CVSS 8.2) in Moodle, published June 23, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.2%, the 97th percentile. Fixed in moodle 3.10.1.