GHSA-c8v6-vxhf-wcrr
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
At a glance
- Published
- Updated
- CVE
- CVE-2025-3641
- Aliases
- BIT-moodle-2025-3641
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.18 |
| Packagist · moodle/moodle | introduced 4.3.0-beta, fixed 4.3.12 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.8 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-3641 ADVISORY
- https://github.com/moodle/moodle/commit/27b839b5c60389623ca8e3496792b43a44527cd6 WEB
- https://access.redhat.com/security/cve/CVE-2025-3641 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2359735 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=467602 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |