Search for vulnerabilities
Vulnerability details: VCID-8h6r-f99m-tqf2
Vulnerability ID VCID-8h6r-f99m-tqf2
Aliases CVE-2025-26525
GHSA-4hmr-39vp-xfrr
Summary Moodle has an arbitrary file read risk through pdfTeX Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-552 Files or Directories Accessible to External Parties
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-26525
epss 0.00067 https://api.first.org/data/v1/epss?cve=CVE-2025-26525
cvssv3.1 8.6 https://github.com/moodle/moodle
generic_textual HIGH https://github.com/moodle/moodle
cvssv3.1 8.6 https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
generic_textual HIGH https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
ssvc Track https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
cvssv3.1 8.6 https://moodle.org/mod/forum/discuss.php?d=466141
generic_textual HIGH https://moodle.org/mod/forum/discuss.php?d=466141
ssvc Track https://moodle.org/mod/forum/discuss.php?d=466141
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2025-26525
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-26525
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-26525
https://github.com/moodle/moodle
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
https://moodle.org/mod/forum/discuss.php?d=466141
https://nvd.nist.gov/vuln/detail/CVE-2025-26525
GHSA-4hmr-39vp-xfrr https://github.com/advisories/GHSA-4hmr-39vp-xfrr
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-24T19:59:34Z/ Found at https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=466141
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-24T19:59:34Z/ Found at https://moodle.org/mod/forum/discuss.php?d=466141
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-26525
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.2117
EPSS Score 0.00067
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:12:27.970330+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-4hmr-39vp-xfrr/GHSA-4hmr-39vp-xfrr.json 36.1.3