CVE-2025-67851
Moodle formula injection vulnerability
6.1
MEDIUM
CVSS 3.1
EPSS 0.05%
Description
A flaw was found in Moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.
How to fix CVE-2025-67851
To remediate CVE-2025-67851, upgrade the affected package to a fixed version below.
- —upgrade to 4.1.22 or later
- —upgrade to 4.1.22 or later
Is CVE-2025-67851 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 4.1.22, >= 4.4.0, < 4.4.11, >= 4.5.0, < 4.5.8, >= 5.0.0, < 5.0.4, >= 5.1.0, < 5.1.1
- from 0, < 4.1.22
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L |