IOMAD 4.3.x Release Notes

Notes

• Initial NES for IOMAD release, forked from IOMAD 4.3.3, which is built on Moodle 4.3.
• Because IOMAD 4.3.3 predates the final upstream Moodle 4.3 release, this release carries two bodies of security fixes: the Moodle advisories published between 4.3.4 and 4.3.12 that the IOMAD 4.3.3 base never received, and every applicable advisory published after 4.3.12.
• 122 advisories in total, covering 104 assigned CVEs. The remaining 18 advisories have no CVE assigned by Moodle at the time of release; this page is updated as identifiers are published.
• Includes fixes for vulnerabilities in third-party libraries vendored into core (ADOdb, FPDI), patched in place.
• $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.4+4.3.3:iomad

Use these values to verify your installation. Build: 20260622 is the date this build was cut, not its release date.

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious

• MSA-26-0028 - DoS via overlong user profile description (length validation). CVE not yet assigned | MDL-87898
• MSA-26-0026 - Missing capability check in assignment marker allocation. CVE not yet assigned | MDL-88529
• MSA-26-0021 - CSRF and XSS in grade item idnumber editing. CVE not yet assigned | MDL-88542
• MSA-26-0017 - IDOR allows arbitrary comment deletion (strict load before delete). CVE not yet assigned | MDL-88619
• MSA-26-0015 - RCE via admin presets import (strengthen import/apply validation). CVE not yet assigned | MDL-88735
• MSA-26-0014 - Arbitrary file read in backup restore. File record data is now validated. CVE not yet assigned | MDL-88736
• MSA-26-0013 - Email-based MFA bypass (improve Email factor validation). CVE not yet assigned | MDL-88767
• MSA-26-0012 - Arbitrary file read in Database activity module (check zip content; clean CSV filenames). CVE not yet assigned | MDL-88595
• MSA-26-0006 - RCE via Google Drive repository plugin (prepared file path must be a name only). CVE-2026-7275 | MDL-88423
• MSA-26-0005 - SQL injection in external database authentication (auth_db). String interpolation is replaced with parameterized queries across the login, user lookup, user existence, and user update paths. CVE-2026-7274 | MDL-88138
• MSA-26-0003 - DoS in TeX formula editor (mimetex timeout handling). CVE-2026-26047 | MDL-86785
• MSA-26-0002 - Remote code execution via the TeX filter admin setting. The background argument in filter/tex/latex.php is escaped and the setting is moved to the colour picker. Colour-picker validation is now anchored, so a value is no longer accepted merely for containing a colour - this hardens every colour-picker setting, not only the TeX one. CVE-2026-26046 | MDL-87870 | MDL-87843
• MSA-26-0001 - RCE via file restore (safer unserializing of repository file source data). CVE-2026-26045 | MDL-87612
• MSA-25-0059 - Reflected XSS in the policy tool via PARAM_LOCALURL. The javascript: pattern in clean_param() is strengthened. CVE-2025-67855 | MDL-86544
  • Behaviour change: the new pattern matches javascript as a whole word anywhere before a : or /, so a relative local URL that merely contains the word is now cleaned to an empty string - for example docs/javascript/index.html. Root-relative and wwwroot-absolute URLs return before the check and are unaffected, and matching is whole-word only, so docs/javascripts/index.html still passes. Sites that route such relative paths through PARAM_LOCALURL must make them root-relative or use a different param type. This is upstream's own trade-off, not a porting artefact.
• MSA-25-0055 - Formula injection when exporting to CSV/Excel/ODS (escape leading =,+,-,@ and control chars in dataformat and grade exports). CVE-2025-67851 | MDL-72744
• MSA-25-0054 - XSS in the formula (equation) editor preview. Input is sanitised in both atto_equation and tiny_equation. CVE-2025-67850 | MDL-85557
• MSA-25-0052 - Authentication via LTI Provider available to suspended users (block suspended accounts in legacy LTI and LTI 1.3 auth). CVE-2025-67848 | MDL-87286
• MSA-25-0051 - RCE via file restore: use the safe unserialize_object() helper instead of raw @unserialize() on stored-file source data in lib/filelib.php and repository/draftfiles_ajax.php, preventing PHP object injection during draft-file save/restore. CVE-2025-67847 | MDL-87353
• MSA-25-0047 - MFA bypass via mfa_pending NO_REDIRECT path. CVE-2025-62398 | MDL-86334
• MSA-25-0042 - Exception handling in bundled FPDI PDF library. CVE-2025-54869 | MDL-86353
• MSA-25-0035 - Missing authorisation checks in BigBlueButton view page. CVE-2025-49517 | MDL-84706
• MSA-25-0033 - Course visibility not honoured consistently. CVE-2025-49515 | MDL-84518
• MSA-25-0032 - SSRF via DNS rebind (bind resolved IPs/ports for cURL). CVE-2025-49514 | MDL-83762
• MSA-25-0031 - SQL escaping in the bundled ADOdb PostgreSQL driver. CVE-2025-46337 | MDL-85375
• MSA-25-0025 - Reflected XSS in the policy tool via PARAM_LOCALURL. Aligns the clean_param() block with the Moodle tree; the security substance is covered by the stronger MSA-25-0059 fix. CVE-2025-3643 | MDL-85104
• MSA-25-0024 - Authenticated RCE in EQUELLA repository (safer unserialize). CVE-2025-3642 | MDL-84473
• MSA-25-0023 - Authenticated RCE in Dropbox repository (safer unserialize). CVE-2025-3641 | MDL-84475
• MSA-25-0014 - User DoS and name disclosure via IDOR in MFA email factor revoke. CVE-2025-3625 | MDL-85015
• MSA-25-0013 - RCE via bundled MimeTeX binary (filter/tex mimetex). CVE-2024-40446 | MDL-85152
• MSA-25-0010 - SQL injection in course search module list filter. CVE-2025-26533 | MDL-84271
• MSA-25-0006 - Reflected XSS via question bank filter. CVE-2025-26530 | MDL-84146
• MSA-25-0005 - Stored XSS in admin live log. CVE-2025-26529 | MDL-84145
• MSA-25-0001 - Arbitrary file read through pdfTeX. CVE-2025-26525 | MDL-84136
• MSA-24-0056 - DoS due to guest sessions' longer timeout period. CVE-2024-55648 | MDL-61316
• MSA-24-0055 - Reflected XSS in question bank filter. CVE-2024-55647 | MDL-83357
• MSA-24-0051 - Unprotected access to sensitive info via learning plan web service. CVE-2024-55643 | MDL-83921
• MSA-24-0042 - Unprotected access to sensitive info via dynamic tables. CVE-2024-45689 | MDL-82567
• MSA-24-0041 - LFI when restoring malformed block backups. CVE-2024-43440 | MDL-82392
• MSA-24-0040 - Reflected XSS via H5P error message. CVE-2024-43439 | MDL-82558
• MSA-24-0037 - Site administration SQL injection via XMLDB editor. CVE-2024-43436 | MDL-82395
• MSA-24-0035 - CSRF in Feedback non-respondents report. CVE-2024-43434 | MDL-82262
• MSA-24-0032 - IDOR in badges allows deletion of arbitrary badges. CVE-2024-43431 | MDL-82390
• MSA-24-0029 - Cache poisoning via injection into storage. Session and local storage keys are now validated. CVE-2024-43428 | MDL-81718
• MSA-24-0027 - Arbitrary file read through pdfTeX. CVE-2024-43426 | MDL-82745
• MSA-24-0026 - RCE via calculated question types (formula regex hardening). CVE-2024-43425 | MDL-82576
• MSA-24-0024 - CSRF risks due to misuse of confirm_sesskey. CVE-2024-38276 | MDL-81890
• MSA-24-0016 - Authenticated LFI via modified mod_data backup. CVE-2024-34005 | MDL-81267
• MSA-24-0015 - Authenticated LFI via modified mod_wiki backup. CVE-2024-34004 | MDL-81284
• MSA-24-0014 - Authenticated LFI via modified mod_workshop backup. CVE-2024-34003 | MDL-80712
• MSA-24-0013 - Authenticated LFI via modified mod_feedback backup. CVE-2024-34002 | MDL-81135
• MSA-24-0007 - Broken access control when setting calendar event type. CVE-2024-33996 | MDL-81247

Minor

• MSA-26-0029 - Report builder fragment callbacks missing access checks (verify can-view/can-edit and audience add permission in filters/audience form fragments). CVE not yet assigned | MDL-84535
• MSA-26-0027 - Blind SSRF in MNet peers function (validate peer hostname). CVE not yet assigned | MDL-87911
• MSA-26-0023 - CSRF when adding quiz section headings (sesskey protection). CVE not yet assigned | MDL-88540
• MSA-26-0022 - CSRF in group messaging state toggle (require_sesskey on enable/disablemessaging; sesskey field in groups index template). CVE not yet assigned | MDL-88541
• MSA-26-0020 - Reflected XSS via Feedback import error message (stricter cleaning). CVE not yet assigned | MDL-88543
• MSA-26-0019 - CSRF in user profile page reset (sesskey check). CVE not yet assigned | MDL-88545
• MSA-26-0018 - CSRF in user homepage preference setting (sesskey check on setdefaulthome in index.php and my/index.php). CVE not yet assigned | MDL-88609
• MSA-26-0016 - Missing group-mode access checks in grade web services. CVE not yet assigned | MDL-88667
• MSA-26-0011 - CSRF and missing capability check in admin/mnet/peers.php. CVE not yet assigned | MDL-84495
• MSA-26-0007 - Messaging DoS from messages of deleted users (validation). CVE not yet assigned | MDL-87760
• MSA-25-0061 - User IDs exposed in URLs with anonymous assignment submissions (use blind id instead of userid in grading table and submission removal). CVE-2025-67857 | MDL-82808
• MSA-25-0060 - Badges with role criterion awarded to users without the role. CVE-2025-67856 | MDL-86507
• MSA-25-0058 - Participants can access ratings without permission. View and view-all rating permissions are now enforced in Forum, Database, and Glossary. CVE-2025-67854 | MDL-86960
• MSA-25-0057 - Password brute force via confirmation-email web service (validation). CVE-2025-67853 | MDL-86326
• MSA-25-0056 - Open redirect in OAuth2 login (restrict redirect to local URLs). CVE-2025-67852 | MDL-80317
• MSA-25-0050 - Bypass timer in timed assignments (respect timer server-side in submission flow). CVE-2025-62401 | MDL-75087
• MSA-25-0049 - Hidden group names visible via group calendar events (event form shows only accessible groups). CVE-2025-62400 | MDL-86261
• MSA-25-0048 - Password brute force via web service auth (stricter login check). CVE-2025-62399 | MDL-86327
• MSA-25-0044 - External cohort search web service leaks system cohort data. CVE-2025-62395 | MDL-85421
• MSA-25-0040 - Profile-access callbacks not enforced in web services (user_get_user_details now runs control_view_profile callbacks; new user_process_profile_callbacks). CVE-2025-62438 | MDL-63395
• MSA-25-0039 - Feedback results ignored Separate Groups mode (new mod_feedback manager::can_see_others_in_groups gate on entries/non-respondents). CVE-2025-62437 | MDL-84463
• MSA-25-0038 - Course Logs / Live Logs reports ignored Separate Groups mode (hide report for teachers without groups; new report_helper::has_valid_group). CVE-2025-62436 | MDL-84464
• MSA-25-0036 - IDOR: fetch other users' recently accessed courses via web service (require moodle/user:viewalldetails). CVE-2025-49518 | MDL-79993
• MSA-25-0034 - CSRF in badges backpack management (add sesskey checks). CVE-2025-49516 | MDL-84497
• MSA-25-0030 - Password revealed on login page after logout (login-page caching). CVE-2025-49513 | MDL-85323
• MSA-25-0028 - IDOR when accessing the cohorts report. CVE-2025-3647 | MDL-84865
• MSA-25-0027 - IDOR in messaging web service exposes user details. CVE-2025-3645 | MDL-72704
• MSA-25-0026 - AJAX section delete bypasses course_can_delete_section(). CVE-2025-3644 | MDL-83994
• MSA-25-0022 - IDOR in web service exposes some user details to enrolled users. CVE-2025-3640 | MDL-84750
• MSA-25-0021 - CSRF in Brickfield tool analysis request action. CVE-2025-3638 | MDL-84478
• MSA-25-0020 - mod_data edit/delete pages pass CSRF token in GET parameter. CVE-2025-3637 | MDL-65356
• MSA-25-0019 - IDOR in RSS block allows access to additional RSS feeds. CVE-2025-3636 | MDL-84499
• MSA-25-0018 - CSRF in user tours manager allows tour duplication. CVE-2025-3635 | MDL-84479
• MSA-25-0017 - Self enrolment available before completing second factor (MFA). CVE-2025-3634 | MDL-84784
• MSA-25-0015 - Some user data available before completing second factor (MFA) (secure layout for guidance page; restrict pre-2FA URLs). CVE-2025-3627 | MDL-84351
• MSA-25-0012 - Hidden grades shown to users without permission on some grade reports. CVE-2025-32045 | MDL-81945
• MSA-25-0009 - Teachers can evade trusttext config when restoring glossary entries. CVE-2025-26532 | MDL-84003
• MSA-25-0008 - IDOR in badges allows disabling of arbitrary badges. CVE-2025-26531 | MDL-84239
• MSA-25-0007 - Security fix in bundled RequireJS (lib/requirejs). CVE-2024-38999 | MDL-84023
• MSA-25-0004 - Stored XSS in ddimageortext question type. CVE-2025-26528 | MDL-82896
• MSA-25-0003 - Non-searchable tags discoverable on tag search page. CVE-2025-26527 | MDL-83941
• MSA-25-0002 - Feedback response viewing/deletions ignored Separate Groups. CVE-2025-26526 | MDL-79976
• MSA-24-0054 - Database activity issue in separate groups mode. CVE-2024-55646 | MDL-82757
• MSA-24-0053 - Email change confirmation token available via preference. CVE-2024-55645 | MDL-82379
• MSA-24-0052 - Tag index page displays other users tagged with the selected tag. CVE-2024-55644 | MDL-82963
• MSA-24-0050 - IDOR when fetching report schedules. CVE-2024-48901 | MDL-83180
• MSA-24-0047 - Some users can delete audiences of other reports. CVE-2024-48898 | MDL-83181
• MSA-24-0046 - IDOR in edit/delete RSS feed. CVE-2024-48897 | MDL-82386
• MSA-24-0045 - Users' names returned in messaging error message. CVE-2024-48896 | MDL-83352
• MSA-24-0044 - Lesson activity password bypass through PHP loose comparison. CVE-2024-45691 | MDL-82365
• MSA-24-0043 - IDOR when deleting OAuth2 linked accounts. CVE-2024-45690 | MDL-76962
• MSA-24-0039 - IDOR in Feedback non-respondents report (message arbitrary users). CVE-2024-43438 | MDL-82261
• MSA-24-0038 - XSS when restoring malicious course backup file. CVE-2024-43437 | MDL-81394
• MSA-24-0036 - Can create global glossary without being admin. CVE-2024-43435 | MDL-64984
• MSA-24-0034 - Matrix user/power level management with suspended users. CVE-2024-43433 | MDL-81951
• MSA-24-0033 - Authorization headers preserved between emulated redirects (respect CURLOPT_UNRESTRICTED_AUTH; strip Authorization header). CVE-2024-43432 | MDL-82136
• MSA-24-0030 - User information visibility control issues in gradebook reports (hidden-field checks in grade user search web services; AMD comboboxsearch rebuilt locally against 4.3.3 sources). CVE-2024-43429 | MDL-79541
• MSA-24-0028 - Admin presets export tool includes secrets (add BBB/tiny_premium/matrix secrets to sensiblesettings; database savepoint renumbered to 2023100904.01). CVE-2024-43427 | MDL-79373
• MSA-24-0025 - QR login key and auto-login key generated separately. CVE-2024-38277 | MDL-80959
• MSA-24-0023 - HTTP authorization header preserved between emulated redirects. CVE-2024-38275 | MDL-81774
• MSA-24-0022 - Stored XSS via calendar event title when deleting event. CVE-2024-38274 | MDL-81412
• MSA-24-0021 - BigBlueButton web service leaks meeting joining information. CVE-2024-38273 | MDL-81778
• MSA-24-0020 - ReCAPTCHA can be bypassed on the login page. CVE-2024-34009 | MDL-81463
• MSA-24-0019 - CSRF in analytics management of models. CVE-2024-34008 | MDL-81059
• MSA-24-0018 - Logout CSRF in admin/tool/mfa/auth.php. CVE-2024-34007 | MDL-80877
• MSA-24-0017 - Unsanitized HTML in site log for config_log_created events. CVE-2024-34006 | MDL-80585
• MSA-24-0012 - CSRF in admin preset tool management of presets. CVE-2024-34001 | MDL-81058
• MSA-24-0011 - Stored XSS in lesson overview report via user ID number. CVE-2024-34000 | MDL-81062
• MSA-24-0010 - Unsafe use of HTTP_REFERER in MFA admin/tool/mfa/index.php. CVE-2024-33999 | MDL-80878
• MSA-24-0009 - Stored XSS via user's name on participants page. CVE-2024-33998 | MDL-81354
• MSA-24-0008 - Stored XSS editing another user's equation in equation editor. CVE-2024-33997 | MDL-81352