CVE-2025-67850
Cross-Site Scripting in Moodle Formula Editor Enables Remote Code Execution
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moodle | moodle | From 4.4.0 (inc) to 4.4.11 (exc) |
| moodle | moodle | From 4.5.0 (inc) to 4.5.8 (exc) |
| moodle | moodle | From 5.0.0 (inc) to 5.0.4 (exc) |
| moodle | moodle | 5.1.0 |
| moodle | moodle | to 4.1.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) flaw in Moodle's formula editor. It occurs because the system does not properly check user input in arithmetic expression fields, allowing a remote attacker to inject malicious code. When other users view these expressions, the malicious code runs in their browsers, potentially compromising their security. [1]
How can this vulnerability impact me? :
The vulnerability can lead to malicious scripts executing in the browsers of users who view the affected arithmetic expressions. This can compromise user data or allow unauthorized actions to be performed on behalf of the user, posing a significant security risk. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Moodle to a version where the formula editor's input filtering is properly fixed. Additionally, restrict user permissions to limit who can input arithmetic expressions, and monitor for suspicious activity related to the formula editor. Applying any patches provided by the Moodle development or your Linux distribution's security team is recommended. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to inject malicious scripts that execute in the browsers of users viewing the affected content, potentially compromising user data or leading to unauthorized actions.
Such unauthorized access or compromise of user data could negatively impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information against unauthorized access or breaches.
However, there is no explicit information provided about direct compliance impacts or mitigation measures related to these standards in the available resources.