Moodle formula injection vulnerability

CAO 7.8CVE-2025-67851 · BIT-moodle-2025-67851 · GHSA-qfh6-h7j6-fvjv · Công bố 03/02/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-67851 là lỗ hổng mức CAO (CVSS 7.8) ảnh hưởng moodle/moodle, moodle (moodle).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.29%, cao hơn 21.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.4.12, 4.5.8, 5.0.4, 5.1.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
moodle/moodle Packagist	`≥ 4.4.0-beta, < 4.4.12≥ 4.5.0-beta, < 4.5.8≥ 5.0.0-beta, < 5.0.4≥ 5.1.0-beta, < 5.1.1< 4.1.22`	`4.4.124.5.85.0.45.1.14.1.22`
moodle moodle	`= 5.1.0≥ 4.4.0, < 4.4.11≥ 4.5.0, < 4.5.8≥ 5.0.0, < 5.0.4< 4.1.22`	`4.4.114.5.85.0.44.1.22`

Mô tả

A flaw was found in Moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.

Mô tả của NVD

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.