Nixpkgs security tracker

Untriaged

Permalink CVE-2025-67847

8.8 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 2 months, 3 weeks ago

Moodle: moodle: remote code execution via insufficient restore input validation

A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application.

References

https://access.redhat.com/security/cve/CVE-2025-67847 vdb-entryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-67847 vdb-entryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-67847 vdb-entryx_refsource_REDHAT

Affected products

moodle

<4.5.8
<4.1.22
<4.1.0
<5.0.4
<5.1.1
<4.4.12

Matching in nixpkgs

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

nixos-unstable 5.0.1
- nixpkgs-unstable 5.0.1
- nixos-unstable-small 5.0.1
nixos-25.11 5.0.4
- nixpkgs-25.11-darwin 5.0.2

pkgs.moodle-dl

Moodle downloader that downloads course content fast from Moodle

nixos-unstable 2.3.13
- nixpkgs-unstable 2.3.13
- nixos-unstable-small 2.3.13
nixos-25.11 2.3.13
- nixpkgs-25.11-darwin 2.3.13

Package maintainers