CVE-2025-26532: Moodle Allows Teachers to Evade Trusttext Config When Restoring Glossary Entries
Summary
CVE-2025-26532: Moodle allows teachers to evade trusttext config when restoring glossary entries. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26532 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed for educators, administrators, and learners. It provides a robust environment for creating personalized learning experiences and managing educational content. The platform supports various features such as course management, quizzes, forums, and glossaries. However, it is susceptible to vulnerabilities that can compromise its security and functionality, including the recent issue where teachers can bypass trusttext configurations when restoring glossary entries.
Vulnerability Detail
The vulnerability arises from insufficient checks in Moodle's glossary restoration process, allowing teachers to evade trusttext configurations when restoring glossary entries. This can lead to the introduction of untrusted content into the system, potentially compromising the integrity of educational materials. The flaw is categorized under CWE-863, which pertains to the reliance on untrusted input. If exploited, this vulnerability can result in the display of malicious content to users, undermining the trustworthiness of the platform.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can manually review and sanitize glossary entries before restoring them to ensure that no untrusted content is introduced. However, this is not a long-term solution and should only be used until the system is updated.
Conclusion
The CVE-2025-26532 vulnerability in Moodle poses a risk by allowing teachers to bypass trusttext configurations when restoring glossary entries. It is crucial for users to update their installations to the latest patched versions to mitigate this risk and ensure the integrity of their educational content.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-26532 is a vulnerability in Moodle that allows teachers to bypass trusttext configurations when restoring glossary entries, potentially leading to the introduction of untrusted content.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability affects Moodle versions prior to 4.5.2, 4.4.6, 4.3.10, and 4.1.16.
Update your Moodle installation to the latest patched version using Composer, and review glossary entries for untrusted content.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
