CVE-2025-26525: Arbitrary file read risk through pdfTeX
Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.16 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.10 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26525?
CVE-2025-26525 has been classified with a severity rating that indicates a serious risk of arbitrary file reading due to insufficient sanitization in the TeX notation filter.
How do I fix CVE-2025-26525?
To fix CVE-2025-26525, upgrade to Moodle versions 4.1.16, 4.3.10, 4.4.6, or 4.5.2 or later.
What systems are affected by CVE-2025-26525?
CVE-2025-26525 affects systems running Moodle that have the pdfTeX feature available.
What is the impact of exploiting CVE-2025-26525?
Exploitation of CVE-2025-26525 can lead to unauthorized reading of sensitive files on the affected Moodle installation.
Is CVE-2025-26525 related to any specific Moodle version?
Yes, CVE-2025-26525 specifically affects certain versions of Moodle prior to the patched releases mentioned.