6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67851

CVE-2025-67851: Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export

A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67851

CVE-2025-67851:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.22	4.1.22
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.12	4.4.12
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.8	4.5.8
moodle/moodle	composer	>= 5.0.0-beta, < 5.0.4	5.0.4
moodle/moodle	composer	>= 5.1.0-beta, < 5.1.1	5.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic formula injection (CWE-1236) in Moodle's data export functionality. The root cause was the failure to sanitize data before including it in exported spreadsheet files (CSV, XLSX, ODS). An attacker could input a string that starts with a formula character (e.g., '=', '+', '-', '@') into any field that gets exported, such as a user's name or a forum post. When a privileged user exports this data and opens the resulting file, the spreadsheet application executes the malicious formula, potentially leading to information disclosure or other attacks.

The patch addresses this by introducing a new centralized function, core\dataformat::escape_spreadsheet_formula, which prepends a single quote (') to any value that could be interpreted as a formula. The analysis of the provided commits shows that four key functions, responsible for writing data into different spreadsheet formats, were modified to use this new escaping function. These functions (csv_writer::add_data, excel_workbook::write_string, ods_workbook::write_string, and spout_base::write_record) are the direct points of vulnerability, as they were the ones handling the unsafe data prior to the fix.

Vulnerable functions

csv_writer::add_data

public/lib/csvlib.class.php

This function writes a row of data to a CSV file. Prior to the patch, it directly passed the data to `fputcsv` without sanitization, allowing malicious formulas (e.g., starting with '=') to be written into the file. An attacker could exploit this by crafting input that, when exported, would execute as a formula in a spreadsheet application. The patch mitigates this by iterating through each cell value and applying `escape_spreadsheet_formula`.

excel_workbook::write_string

public/lib/excellib.class.php

This function writes a string value to a cell in an Excel spreadsheet. Before the patch, it wrote the raw string value without checking for characters that could initiate a formula. This allowed for formula injection. The patch adds a call to `escape_spreadsheet_formula` to sanitize the string before it is written to the cell.

ods_workbook::write_string

public/lib/odslib.class.php

This function writes a string value to a cell in an OpenDocument Spreadsheet (ODS) file. It was vulnerable to formula injection because it did not sanitize the input string before writing it. An attacker could provide a malicious formula as input. The patch fixes this by calling `escape_spreadsheet_formula` on the string.

spout_base::write_record

public/lib/classes/dataformat/spout_base.php

This function writes a record to a spreadsheet using the Spout library. The vulnerability existed because the values from `format_record` were used to create a new row without sanitization. An attacker's malicious input could be passed through, resulting in formula injection. The patch adds a loop to apply `escape_spreadsheet_formula` to each value before creating the row.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.