CVE-2025-67847
High · 8.8CVSS
8.8
EPSS
0.6%
Published
Jan 23, 2026
CISA due date
—
The record
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | moodle/moodle | 0 | 4.1.22 |
| Packagist | moodle/moodle | 4.2.0-beta | 4.4.12 |
| Packagist | moodle/moodle | 4.5.0-beta | 4.5.8 |
| Packagist | moodle/moodle | 5.0.0-beta | 5.0.4 |
| Packagist | moodle/moodle | 5.1.0-beta | 5.1.1 |
| packagist | moodle/moodle | 4.2.0-beta | 4.4.12 |
| packagist | moodle/moodle | 4.5.0-beta | 4.5.8 |
| packagist | moodle/moodle | 5.0.0-beta | 5.0.4 |
| packagist | moodle/moodle | 5.1.0-beta | 5.1.1 |
Related vulnerabilities
- GHSA-xvmh-25jw-gmmm Moodle affected by a code injection vulnerability Same vulnerability
- GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore Also affects moodle/moodle
- GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits Also affects moodle/moodle
- CVE-2026-26047 A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. Also affects moodle/moodle
- CVE-2026-26045 A flaw was identified in Moodle’s backup restore functionality where specially crafted… Also affects moodle/moodle
- GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts Also affects moodle/moodle
- GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data Also affects moodle/moodle
- GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw Also affects moodle/moodle