Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-67847

Moodle: moodle: remote code execution via insufficient restore input validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

moodle

Default version status: unaffected

  • 5.1.0 to < 5.1.1affected
  • 5.0.0 to < 5.0.4affected
  • 4.5.0 to < 4.5.8affected
  • 4.4.0 to < 4.4.12affected
  • 4.1.0 to < 4.1.22affected
  • 0 to < 4.1.0affected

References