CVE-2025-26529: Moodle Stored XSS Vulnerability in Admin Live Log
Summary
CVE-2025-26529: Moodle has a stored XSS risk in admin live log. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26529 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a variety of features including course management, user management, and reporting tools. However, it has been identified that certain information displayed in the site administration live log lacks proper sanitization, making it susceptible to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of description information in the site administration live log. This oversight allows attackers to inject malicious scripts that can be executed in the context of an administrator's session. The ramifications of this vulnerability include unauthorized access to sensitive information, potential data manipulation, and the ability to perform actions on behalf of the administrator, leading to a compromise of the entire system. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, administrators can limit access to the live log feature until the package is updated. Additionally, implementing a web application firewall (WAF) may help mitigate the risk of XSS attacks.
Conclusion
In summary, the stored XSS vulnerability in Moodle's admin live log poses significant risks to the security of the platform. It is crucial for users to update to the patched versions to mitigate these risks. Utilizing tools like Vulert can assist in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
Stored XSS is a type of vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed when users access the affected page.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
The potential impacts include unauthorized access to sensitive data, manipulation of user sessions, and the ability to perform actions on behalf of the administrator, which can lead to a complete system compromise.
Yes, implementing proper input validation and output encoding, along with using security headers like Content Security Policy (CSP), can significantly reduce the risk of XSS attacks.
The vulnerability has a CVSS score of 8.3, indicating a high severity level that requires immediate attention and remediation.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
