CVE-2025-3641

Description

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

Reserved 2025-04-15 | Published 2025-04-25 | Updated 2025-04-28 | Assigner fedora

Problem types

Improper Control of Generation of Code ('Code Injection')

Product status

Default status
unaffected

4.5.0 before 4.5.4
affected

4.4.0 before 4.4.8
affected

4.3.0 before 4.3.12
affected

4.1.0 before 4.1.18
affected

Timeline

2025-04-15:	Reported to Red Hat.
2025-04-22:	Made public.

Credits

Red Hat would like to thank Vincent Schneider for reporting this issue.

References

access.redhat.com/security/cve/CVE-2025-3641 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2359735 (RHBZ#2359735) issue-tracking

moodle.org/mod/forum/discuss.php?d=467602

cve.org (CVE-2025-3641)

nvd.nist.gov (CVE-2025-3641)

Download JSON