Log in Start free

Vulnerability · Published Feb 3, 2026 · Assigned by fedora

CVE-2025-67851Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export

Medium 6.1

In plain English

A medium-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 78.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle4.1.22GHSA-qfh6-h7j6-fvjv
Packagistmoodle/moodle4.4.12GHSA-qfh6-h7j6-fvjv
Packagistmoodle/moodle4.5.8GHSA-qfh6-h7j6-fvjv
Packagistmoodle/moodle5.0.4GHSA-qfh6-h7j6-fvjv
Packagistmoodle/moodle5.1.1GHSA-qfh6-h7j6-fvjv

Affected products (as reported)

VendorProductVersions
moodle 4.1.0 – before 4.1.224.4.0 – before 4.4.124.5.0 – before 4.5.85.0.0 – before 5.0.45.1.0 – before 5.1.1

Weakness: CWE-1236 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

References