7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67850

CVE-2025-67850: Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editor

A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67850

CVE-2025-67850:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.22	4.1.22
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.12	4.4.12
moodle/moodle

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue in the Moodle TinyMCE equation editor, caused by insufficient sanitization of user-provided data in the preview feature. The analysis of the patch commit c85f153068a717a3b28bc122e75154bac99e67e1 reveals the exploitation path and the subsequent fix.

The vulnerable workflow is as follows:

On the client side, the updatePreview function in ui.js captures user input from the equation editor to generate a live preview.
It calls the filterEquation function in repository.js, which sends the input to the server via an AJAX call.
The AJAX request is handled by the execute method of the \tiny_equation\external\filter class in filter.php.
Critically, before the patch, this execute method passed the user's raw input directly to the filter_manager::instance()->filter_text() function without any sanitization. This allowed malicious HTML and JavaScript to be processed as part of the equation.
The server returned the processed string, including the malicious script, back to the client.
The updatePreview function then used innerHTML to inject this returned content into the preview area, causing the script to execute in the browser.

The patch rectifies this by introducing a sanitization step. A new boolean parameter, $striptags, is added to the execute method. When this parameter is true, the server uses clean_param($content, PARAM_NOTAGS) to strip all HTML tags from the input before it is processed. The client-side updatePreview function is also modified to call filterEquation with this new parameter set to true, ensuring that all content rendered in the preview is properly sanitized, thus mitigating the XSS risk.

Vulnerable functions

\tiny_equation\external\filter::execute

public/lib/editor/tiny/plugins/equation/classes/external/filter.php

This server-side external API function received raw content from the equation editor. Before the patch, it passed this content to the `filter_text` function without sanitizing it for HTML tags. This allowed an attacker to inject malicious HTML and script content, which would be rendered in the equation preview, leading to a cross-site scripting (XSS) vulnerability. The fix introduces a `$striptags` parameter and uses `clean_param` with `PARAM_NOTAGS` to strip tags when requested for the preview.

updatePreview

public/lib/editor/tiny/plugins/equation/amd/src/ui.js

This client-side Javascript function is responsible for updating the equation preview in real-time. It takes the content from the editor and calls the `filterEquation` function to get the rendered preview from the server. Before the patch, it did not request that the server strip HTML tags, thus allowing the unsanitized and malicious content returned from the server to be rendered in the preview pane via `preview.innerHTML = data.content;`, triggering the XSS.

filterEquation

public/lib/editor/tiny/plugins/equation/amd/src/repository.js

This client-side Javascript function constructs and sends the AJAX request to the server's `tiny_equation_filter` external method. The original version of this function did not include a parameter to request content sanitization, thereby facilitating the XSS vulnerability by passing raw, potentially malicious, user input to the server-side `execute` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.