MSA-25-0055: Formula injection risk when exporting data to CSV / Excel

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2025-12-15 12:21 UTC
  • Importiert: 2026-06-20 16:03 UTC
  • CVSS: 6.1
  • Quelle-ID: moodle
  • uid_hash: 34d545c0fbc8c2431085e64c81e9c602b49d8332f7f91e59bb473c3615d3bb3f
Moodle Security Announcements

Inhalt

by Michael Hawkins.

Insufficient sanitizing when exporting data to CSV / XLSX format could result in malicious formulas being inserted into the files.

Note: Most modern spreadsheet software will warn users and require confirmation before running potentially risky formulas, however this is still considered a risk as users may still accept the warning.

Severity/Risk: Serious

Versions affected: 5.1, 5.0 to 5.0.3, 4.5 to 4.5.7, 4.4 to 4.4.11, 4.1 to 4.1.21 and earlier unsupported versions

Versions fixed: 5.1.1, 5.0.4, 4.5.8, 4.4.12 and 4.1.22

Reported by: Brendan Heywood

CVE identifier: CVE-2025-67851

Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72744

Tracker issue: MDL-72744 Formula injection risk when exporting data to CSV / Excel

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2025-67851

MEDIUM

6.1

MEDIUM

6.1

2026-02-03

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Moodle Security Announcements

moodle

 vendor_advisory cms - de https://moodle.org/rss/file.php/154821/7ef1adaa0762dfdd7cd390868b6d9f2b/mod_forum/996/rss.xml
Zurueck zur Eintrags-Liste