CVE-2025-67851: Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.
Other sources
A formula injection flaw occurred when data fields were exported without proper escaping, allowing spreadsheet formulas to execute when files are opened. This impacts data integrity and can lead to unintended operations.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67851?
CVE-2025-67851 is rated as a high severity vulnerability due to its potential to allow arbitrary formula execution.
How do I fix CVE-2025-67851?
To fix CVE-2025-67851, upgrade to Moodle version 5.1.1, 5.0.4, 4.5.8, 4.4.12, or ensure you are running 4.1.22 or later.
What types of attacks can exploit CVE-2025-67851?
Attackers can exploit CVE-2025-67851 to execute arbitrary formulas by manipulating unescaped data during export.
Which versions of Moodle are affected by CVE-2025-67851?
CVE-2025-67851 affects multiple Moodle versions including those before 5.1.1, 5.0.4, 4.5.8, 4.4.12, and prior to 4.1.22.
What is the impact of not addressing CVE-2025-67851?
Failing to address CVE-2025-67851 can lead to unauthorized formula execution, potentially compromising the integrity of exported data.