CVE-2025-67847 | THREATINT

Description

A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.

PUBLISHED Reserved 2025-12-12 | Published 2026-01-23 | Updated 2026-02-03 | Assigner fedora

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Control of Generation of Code ('Code Injection')

Product status

Default status

unaffected

5.1.0 (semver) before 5.1.1

affected

5.0.0 (semver) before 5.0.4

affected

4.5.0 (semver) before 4.5.8

affected

4.4.0 (semver) before 4.4.12

affected

4.1.0 (semver) before 4.1.22

affected

Any version before 4.1.0

affected

Timeline

2025-12-19:	Reported to Red Hat.
2025-12-15:	Made public.

Credits

Red Hat would like to thank Dinhnhi for reporting this issue.

References

access.redhat.com/security/cve/CVE-2025-67847 vdb-entry

cve.org (CVE-2025-67847)

nvd.nist.gov (CVE-2025-67847)

Download JSON