# CVE-2025-67847: moodle RCE — Fixed in 5.1.1 🐘 🐘 Packagist Not in CISA KEV HIGH severity # CVE-2025-67847 — moodle HIGH CVE-2025-67847 is a high-severity (CVSS 8.8) Code Injection vulnerability in moodle/moodle. A fix is available for moodle/moodle — see the affected versions and patch details below. Moodle: moodle: remote code execution via insufficient restore input validation Also known asBIT-moodle-2025-67847[GHSA-xvmh-25jw-gmmm](/vulnerability/GHSA-xvmh-25jw-gmmm) Published Jan 23, 2026 Updated Oct 28, 2026 Affected 5 pkgs Patched 5 / 5 Exploits None indexed Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - A successful exploit gives an attacker total control of the affected component, not partial access. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-67847. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.6%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs48th percentile — riskier than 48% of all scored CVEsHighest risk 0.00%0.36%0.72%1.08%0.0%0.6%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 5 pkgs affected 🐘`moodle/moodle`🐘`moodle/moodle`🐘`moodle/moodle`🐘`moodle/moodle`🐘`moodle/moodle` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application. ## Affected Packages 5 total 5 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `moodle/moodle` ≥ 5.1.0-beta&&< 5.1.1 5.1.1`composer require moodle/moodle:^5.1.1` 🐘Packagist `moodle/moodle` ≥ 5.0.0-beta&&< 5.0.4 5.0.4`composer require moodle/moodle:^5.0.4` 🐘Packagist `moodle/moodle` ≥ 4.5.0-beta&&< 4.5.8 4.5.8`composer require moodle/moodle:^4.5.8` 🐘Packagist `moodle/moodle` ≥ 4.2.0-beta&&< 4.4.12 4.4.12`composer require moodle/moodle:^4.4.12` 🐘Packagist `moodle/moodle` all versions 4.1.22`composer require moodle/moodle:^4.1.22` ## Affected Products 1 product · 5 configurations Application `moodle`moodle ≥ 5.0.0 && < 5.0.4 1 version 5.1.0 ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for moodle/moodle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update moodle/moodle to 5.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-67847 is resolved across your whole dependency graph. 3. ### Workarounds Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does. ## Frequently Asked Questions A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful exploitation could result in a full compromise of the Moodle application. O3 Security · Impact-Aware SCA ### Is CVE-2025-67847 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)