CVE-2025-62396: Moodle: router (r.php) could expose application directories
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
Other sources
Improper error handling in the routing mechanism could result in directory listings being returned to clients when “Accept: text/html” headers were missing. This could expose file structure or sensitive information about the application environment.
Versions affected: 5.0 to 5.0.2 and 4.5 to 4.5.6 Versions fixed: 5.0.3 and 4.5.7
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62396?
CVE-2025-62396 is classified as a moderate severity vulnerability.
How does CVE-2025-62396 affect Moodle?
CVE-2025-62396 affects Moodle by potentially exposing internal directory listings due to improper HTTP header configurations.
How do I fix CVE-2025-62396?
To fix CVE-2025-62396, ensure proper configuration of HTTP headers in the Moodle router (r.php).
What versions of Moodle are affected by CVE-2025-62396?
CVE-2025-62396 affects all versions of Moodle that utilize the r.php router.
What is the primary risk associated with CVE-2025-62396?
The primary risk of CVE-2025-62396 is the potential exposure of sensitive internal directory information.