CVE-2025-26533: Moodle SQL Injection Risk in Course Search Module
Summary
CVE-2025-26533: Moodle has a SQL injection risk in course search module list filter. Affects moodle/moodle across 4 version ranges.
< 4.1.16
>= 4.3.0-beta, < 4.3.10
>= 4.4.0-beta, < 4.4.6
>= 4.5.0-beta, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-26533 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a variety of features including course management, user management, and customizable learning paths. However, like many complex systems, Moodle can be vulnerable to security risks, including SQL injection attacks, which can compromise the integrity and confidentiality of the data it manages.
Vulnerability Detail
An SQL injection risk was identified in the module list filter within the course search functionality of Moodle. This vulnerability allows an attacker to manipulate SQL queries by injecting malicious input, potentially leading to unauthorized access to sensitive data, data corruption, or even complete system compromise. The vulnerability affects multiple versions of Moodle, specifically those introduced from version 4.3.0-beta up to 4.5.0-beta, and can be exploited if proper input validation is not implemented.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.164.1.16composer require moodle/moodle:4.1.16 -
>= 4.3.0-beta, < 4.3.104.3.10composer require moodle/moodle:4.3.10 -
>= 4.4.0-beta, < 4.4.64.4.6composer require moodle/moodle:4.4.6 -
>= 4.5.0-beta, < 4.5.24.5.2composer require moodle/moodle:4.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit access to the course search functionality or implement additional input validation measures to sanitize user inputs until the update can be applied. However, this is not a permanent solution and should only be used as a stopgap.
Conclusion
The SQL injection vulnerability identified in Moodle's course search module poses a significant risk to users and their data. It is crucial for administrators to update their installations to the latest patched versions to mitigate this risk. Additionally, employing best practices for input validation can further enhance security against such vulnerabilities.
See every vulnerability recorded for moodle/moodle →
FAQ
SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data that they are not normally able to retrieve.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in your software without requiring any installation.
Failing to address this vulnerability could lead to unauthorized access to sensitive data, data corruption, and potential complete system compromise, which can have severe implications for users and administrators.
Yes, preventing SQL injection attacks involves using prepared statements, parameterized queries, and proper input validation to ensure that user inputs are sanitized before being processed by the database.
The CVSS score of this vulnerability is 8.1, indicating a high severity level that requires immediate attention.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
