CVE-2025-3642: Moodle

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.

Affected products

• Moodle Moodle: before 4.1.18 (fixed in 4.1.18); from 4.3.0, before 4.3.12 (fixed in 4.3.12); from 4.4.0, before 4.4.8 (fixed in 4.4.8); from 4.5.0, before 4.5.4 (fixed in 4.5.4)

Published 2025-04-25. Last modified 2026-06-17.