CVE-2025-3641

Summary

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled.

Affected Software

VendorProductVersion RangeStatus
4.5.0 < 4.5.4affected
4.4.0 < 4.4.8affected
4.3.0 < 4.3.12affected
4.1.0 < 4.1.18affected

Weaknesses

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References