CVE-2025-67850: Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
Other sources
An XSS issue in the formula editor stemmed from inadequate filtering of user input in arithmetic expression fields. This could allow malicious script to run in the browsers of users viewing those expressions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67850?
CVE-2025-67850 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2025-67850?
To mitigate CVE-2025-67850, upgrade to Moodle version 5.1.1, 5.0.4, 4.5.8, 4.4.12, or 4.1.22.
What causes CVE-2025-67850?
CVE-2025-67850 is caused by inadequate input filtering in the formula editor's arithmetic expression fields.
Who is affected by CVE-2025-67850?
Users of affected Moodle versions are vulnerable to CVE-2025-67850, which exploits insufficient checks on user-provided data.
Is there a workaround for CVE-2025-67850?
No known workaround exists for CVE-2025-67850, and updating to a fixed version is recommended.