CVE-2025-26530: Moodle Question Bank Filter XSS Flaw

CVE-2025-26530 Overview

CVE-2025-26530 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Moodle learning management system. The vulnerability exists in the question bank filter component, which failed to properly sanitize user-supplied input before reflecting it back to users. This allows attackers to inject malicious JavaScript code that executes in the context of a victim's browser session when they click on a crafted link.

Critical Impact

Attackers can steal session cookies, perform actions on behalf of authenticated users, redirect users to malicious sites, or deface content within the Moodle platform.

Affected Products

• Moodle LMS (multiple versions affected)
• Moodle Question Bank Filter component
• Moodle deployments with default configurations

Discovery Timeline

• 2025-02-24 - CVE-2025-26530 published to NVD
• 2025-08-11 - Last updated in NVD database

Technical Details for CVE-2025-26530

Vulnerability Analysis

This reflected XSS vulnerability stems from insufficient input sanitization in Moodle's question bank filter functionality. The question bank is a core component of Moodle that allows educators to create, organize, and manage quiz questions. When users interact with the filter feature to search or sort questions, the application reflects certain parameters back to the page without proper encoding or sanitization.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which encompasses XSS vulnerabilities. The attack requires user interaction—specifically, a victim must click on a maliciously crafted URL containing the XSS payload. Once triggered, the malicious script executes within the victim's browser session with full access to their Moodle authentication context.

The scope is changed, meaning successful exploitation can affect resources beyond the vulnerable component, potentially impacting confidentiality and integrity of user sessions and data within the Moodle platform.

Root Cause

The root cause is inadequate input validation and output encoding in the question bank filter component. When user-supplied data is passed through filter parameters, the application fails to properly sanitize special characters such as <, >, ", and ' before incorporating them into the HTML response. This allows attackers to break out of the expected context and inject arbitrary HTML or JavaScript code.

Attack Vector

The attack is network-based and requires user interaction. An attacker would craft a malicious URL containing JavaScript code in the vulnerable filter parameter and distribute it through phishing emails, social engineering, or by embedding the link in forums or other platforms. When an authenticated Moodle user clicks the link, the reflected payload executes in their browser.

The vulnerability can be exploited to perform session hijacking by stealing authentication cookies, credential theft through fake login forms, unauthorized actions on behalf of the victim user, or defacement of the Moodle interface visible to the targeted user.

Detection Methods for CVE-2025-26530

Indicators of Compromise

• Unusual URL parameters in web server logs containing JavaScript code or encoded script tags
• Requests to the question bank filter endpoint with suspicious payloads such as <script>, onerror=, or javascript:
• Reports from users about unexpected behavior or redirects when accessing Moodle
• Web Application Firewall (WAF) alerts for XSS pattern matches in requests

Detection Strategies

• Enable and monitor web server access logs for requests containing XSS payloads in query parameters
• Deploy WAF rules to detect and block common XSS patterns targeting the question bank filter
• Implement Content Security Policy (CSP) headers to mitigate script execution and detect violations
• Configure browser-based XSS auditors where applicable and monitor for triggered protections

Monitoring Recommendations

• Review Apache or Nginx access logs for anomalous requests to /question/bank/ endpoints
• Set up alerting for unusual patterns in user-agent strings or referrer headers associated with XSS campaigns
• Monitor for sudden increases in requests with encoded characters such as %3Cscript%3E in URLs
• Track CSP violation reports to identify attempted XSS exploitation

How to Mitigate CVE-2025-26530

Immediate Actions Required

• Update Moodle to the latest patched version addressing MDL-84146 immediately
• Review and strengthen Content Security Policy headers to restrict inline script execution
• Enable HttpOnly and Secure flags on session cookies to limit cookie theft impact
• Educate users about the risks of clicking untrusted links to Moodle

Patch Information

Moodle has released security patches addressing this vulnerability. The fix is tracked under MDL-84146 in the Moodle Git repository. Administrators should consult the Moodle Security Forum for detailed information about affected versions and upgrade paths. Apply the official patches as soon as possible to remediate this vulnerability.

Workarounds

• Implement a Web Application Firewall with rules to block XSS payloads targeting the question bank filter
• Restrict access to the question bank functionality to trusted internal networks if possible
• Deploy browser-level protections such as strict CSP headers with script-src 'self' directive
• Consider temporarily disabling or limiting access to the affected filter functionality until patches are applied

# Example Apache configuration to add security headers
<IfModule mod_headers.c>
    # Add Content Security Policy to mitigate XSS
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
    # Ensure cookies are secure
    Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict
    # Enable XSS protection
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
</IfModule>