CVE-2025-26532: Moodle Package Vulnerability Allows Trusttext Configuration Evasion in Glossary Restorations
Summary
CVE-2025-26532: Teachers can evade trusttext config when restoring glossary entries. Affects moodle across 4 version ranges.
>= 4.1.0, < 4.1.16
>= 4.3.0, < 4.3.10
>= 4.4.0, < 4.4.6
>= 4.5.0, < 4.5.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2025-26532 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers a wide range of features, including course management, user management, and content delivery. However, certain versions of Moodle are susceptible to a vulnerability that allows teachers to bypass trusttext configuration when restoring glossary entries, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from insufficient checks in the restoration process of glossary entries when the trusttext feature is enabled. This oversight allows teachers to manipulate glossary entries in a way that could compromise the integrity of the content being restored. If exploited, this could lead to unauthorized content being displayed, which may affect the learning environment and user trust.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.1.164.1.16 -
>= 4.3.0, < 4.3.104.3.10 -
>= 4.4.0, < 4.4.64.4.6 -
>= 4.5.0, < 4.5.24.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as possible to mitigate any risks.
Conclusion
In summary, CVE-2025-26532 presents a significant risk to Moodle installations, allowing unauthorized manipulation of glossary entries. It is essential for users to update to the patched versions to ensure the security and integrity of their learning environments.
See every vulnerability recorded for moodle →
FAQ
CVE-2025-26532 is a vulnerability in the Moodle package that allows teachers to bypass trusttext configuration when restoring glossary entries.
The affected versions include Moodle 4.1.0 to 4.1.15, 4.3.0 to 4.3.9, 4.4.0 to 4.4.5, and 4.5.0 to 4.5.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible to avoid potential exploitation.
You can find detailed information about CVE-2025-26532 on the official GitHub repository and vulnerability databases.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
