Moodle: moodle: remote code execution via insufficient restore input validation

Summary

The vulnerability CVE-2025-67847 affects the Moodle open-source learning platform. An attacker with access to the restore interface can trigger server-side execution of arbitrary code due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines [1][2].

Root

Cause The core restore routines in Moodle fail to properly validate input supplied through the restore interface. This allows an attacker to inject malicious data that is then interpreted as executable code by the server-side restore process. The flaw lies in the lack of sanitization or verification of restore data before it is processed [2].

Exploitation and

Impact To exploit the vulnerability, an attacker needs to have access to the restore interface, which typically requires an authenticated user with appropriate roles (such as a teacher or admin). No further user interaction is required beyond uploading a specially crafted restore file. Successful exploitation can lead to full compromise of the Moodle application, including the ability to execute arbitrary commands on the server, access sensitive data, and potentially pivot to other systems [1][2].

Mitigation

As of publication, no specific patch version has been announced. Users are advised to monitor official Moodle channels and apply updates as soon as they become available. Restrict access to the restore interface to trusted users as a temporary mitigation [1][2].