Skip to content

2026-02-03 — Moodle security fixes: XSS + formula injection + open redirect (CVE-2025-67850/67851/67852)

Signal: Multiple new GitHub-reviewed advisories published 2026-02-03 for moodle/moodle.

Summary

Moodle has fixes available for: - CVE-2025-67850 — XSS in formula editor arithmetic expression fields (High) - CVE-2025-67851 — Formula injection during export when data fields aren’t escaped (Moderate) - CVE-2025-67852 — Open redirect in OAuth login flow (redirect parameter validation) (Low)

Affected / fixed versions (per GitHub Advisory)

Affected: - < 4.1.22 - >= 4.4.0-beta, < 4.4.12 - >= 4.5.0-beta, < 4.5.8 - >= 5.0.0-beta, < 5.0.4 - >= 5.1.0-beta, < 5.1.1

Fixed: - 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1

Why this matters

Even “low” issues like open redirects become high-impact when chained into: - credential phishing after legitimate SSO flows - session fixation/social engineering

And XSS in an LMS can mean: - account takeover for teachers/admins - content tampering / malicious links in course pages

Triage (15–30 minutes)

  1. Identify Moodle instances (including departmental installs)
  2. Confirm whether SSO/OAuth is enabled (for open-redirect risk)
  3. Review where exports are used (CSV/Excel workflows; formula injection risk)
  4. Collect quick logs
  5. web access logs around login flows and content editing routes

Mitigation (do now)

  1. Update Moodle to a fixed version for your branch (above).
  2. Hardening while you patch
  3. Restrict admin/teacher access to trusted networks if possible.
  4. Tighten Content Security Policy (CSP) if you already maintain one (can blunt XSS impact).
  5. CSV/Excel safety
  6. Treat exported spreadsheets as untrusted.
  7. If you must open exports, open with protections enabled and avoid enabling external content/macros.

Hunt / detection ideas

  • Unexpected script tags / HTML in formula editor fields
  • Suspicious redirect chains post-authentication
  • Complaints of “weird spreadsheet behavior” after exports (cells starting with =, +, -, @)

References