Vulnerability · Published Feb 3, 2026 · Assigned by fedora
CVE-2025-67850Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor
High 7.3
In plain English
A high-severity cross-site scripting in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 4.1.22 | GHSA-6mmv-f6c6-v6q8 |
| Packagist | moodle/moodle | 4.4.12 | GHSA-6mmv-f6c6-v6q8 |
| Packagist | moodle/moodle | 4.5.8 | GHSA-6mmv-f6c6-v6q8 |
| Packagist | moodle/moodle | 5.0.4 | GHSA-6mmv-f6c6-v6q8 |
| Packagist | moodle/moodle | 5.1.1 | GHSA-6mmv-f6c6-v6q8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| moodle | 4.1.0 – before 4.1.224.4.0 – before 4.4.124.5.0 – before 4.5.85.0.0 – before 5.0.45.1.0 – before 5.1.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2025-67850 vdb-entry, x_refsource_REDHAT
- RHBZ#2423838 issue-tracking, x_refsource_REDHAT