CVE-2025-67847
Published: 23 January 2026
Summary
CVE-2025-67847 is a high-severity Code Injection (CWE-94) vulnerability in Moodle Moodle. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67847 is a code injection vulnerability (CWE-94) in Moodle, published on 2026-01-23, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw stems from insufficient validation of input in the restore interface, allowing unintended interpretation by core restore routines. This enables an attacker with access to the restore interface to trigger server-side execution of arbitrary code, potentially leading to full compromise of the Moodle application.
An attacker requires low privileges (PR:L) and network access to exploit this vulnerability with low complexity and no user interaction. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, allowing arbitrary code execution on the server hosting Moodle. This could enable attackers to escalate privileges, steal data, modify content, or disrupt services within the affected Moodle instance.
Further details on mitigation, including patches and workarounds, are available in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2025-67847.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4324
Vulnerability details
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restore input, which leads to unintended interpretation by core restore routines. Successful…
more
exploitation could result in a full compromise of the Moodle application.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Code injection in public-facing Moodle restore interface directly enables remote arbitrary code execution (T1190) and subsequent command/script interpreter abuse (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of information inputs, directly mitigating the insufficient validation of restore interface inputs that enables arbitrary code execution.
Mandates identification, reporting, and correction of system flaws like this code injection vulnerability, ensuring patches are applied to prevent exploitation.
Enforces least privilege to restrict access to the vulnerable restore interface, reducing the attack surface for low-privilege users.