GitHub Advisoryadvisory · Packagist

GHSA-4hmr-39vp-xfrr Moodle has an arbitrary file read risk through pdfTeX

HIGH Published 2025-02-24 Modified 2025-02-24 Official page ↗
Aliases
CVE-2025-26525
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-552
Reviewed
2025-02-24

Affected packages

• Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.2 → fixed in 4.5.2 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.6 → fixed in 4.4.6 • Packagist moodle/moodle: >= 4.3.0-beta, < 4.3.10 → fixed in 4.3.10 • Packagist moodle/moodle: < 4.1.16 → fixed in 4.1.16

Description

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Related

Alias · CVE (1)

  • CVE-2025-26525 Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as… vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References