CVE-2025-3642: Moodle Package Remote Code Execution Risk in EQUELLA Repository
Summary
CVE-2025-3642: Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely used open-source learning management system (LMS) that enables educators to create and manage online courses. It offers a variety of features including course management, user enrollment, and content delivery. The EQUELLA repository is an integration within Moodle that allows users to access and manage digital resources. However, a recent vulnerability has been identified that poses a significant risk to sites using this repository.
Vulnerability Detail
A flaw was discovered in the Moodle LMS that allows for authenticated remote code execution through the EQUELLA repository. This vulnerability is particularly concerning as it is accessible by default to teachers and managers on sites where the EQUELLA repository is enabled. The potential ramifications include unauthorized access to sensitive data, manipulation of course content, and the execution of arbitrary code on the server, which could lead to further exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, it is advisable to disable the EQUELLA repository until the package can be updated to a secure version. This can be done through the Moodle admin interface by navigating to Site administration > Plugins > Repositories > Manage repositories and disabling the EQUELLA repository.
Conclusion
The identified vulnerability in Moodle's EQUELLA repository poses a serious risk to users and their data. It is crucial to update to the patched versions of the Moodle package to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-3642 is a vulnerability in the Moodle LMS that allows for remote code execution through the EQUELLA repository.
Sites using the Moodle LMS with the EQUELLA repository enabled are at risk, particularly those with teacher and manager roles.
The vulnerability could lead to unauthorized access to sensitive data, manipulation of course content, and execution of arbitrary code on the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
