← Back

CVE-2025-67851

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.

Affected (5)

Products: Moodle: Moodle
Moodle
1 product
Moodle
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Moodle
Moodle
Before 4.1.22
Moodle
From 4.4.0 to 4.4.11
Moodle
From 4.5.0 to 4.5.8
Moodle
From 5.0.0 to 5.0.4
Moodle
Version 5.1.0

Related CWEs

CWE-1236
Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (3)

Source: patrick@puiterwijk.org
Third Party Advisory
Source: patrick@puiterwijk.org
Issue TrackingThird Party Advisory
Source: patrick@puiterwijk.org
Vendor Advisory

Timeline

No history available yet.