HeroDevs
Visit NES for IOMAD Home Page

IOMAD 4.3.x Release Notes

2 versions

Comprehensive release notes and changelog for IOMAD 4.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Oct 12, 2026
Latest: 4.3.5
122 Patched Vulnerabilities
VEX Statements

October 2026

4.3.5

Released Oct 12, 2026
Full Version: 
4.3.5+4.3.3:iomad

Notes

  • Backports 11 advisories published since NES for IOMAD 4.3.4 that apply to the 4.3 line. None has a CVE assigned by Moodle at the time of release; this page is updated as identifiers are published.
  • CVEs are now assigned to the 18 advisories in 4.3.4 that had none at its release, and those entries below are updated.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.5+4.3.3:iomad

Install this release with the installation guide, including the database update. IOMAD does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20261008 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.5+4.3.3 (Build: 20261008)
Core $version2023100905.00
local_iomad $plugin->version2026100800

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0042 - Blind SQL injection in profile availability condition (reject standard field names not in the allowlist). CVE not yet assigned | MDL-89484
  • MSA-26-0041 - CSRF in XML grade imports. import.php now rejects direct access outside key login, and interactive imports run from the sesskey-protected form. CVE not yet assigned | MDL-84545
  • MSA-26-0032 - User profile information disclosure via grade web service (get_gradable_users now requires moodle/site:viewuseridentity instead of moodle/course:viewparticipants). CVE not yet assigned | MDL-89381
  • MSA-26-0031 - SQL injection in question bank web service (entryid is cleaned as an integer and bound as a query parameter). CVE not yet assigned | MDL-89383
  • MSA-26-0030 - SSRF in URL downloader via IPv4-mapped IPv6 addresses (address_in_subnet() also checks the unwrapped IPv4 form against the blocked-hosts list). CVE not yet assigned | MDL-88779
Minor
  • MSA-26-0043 - Login notification bypass via spoofed Moodle App user agent. The user-agent exemption is removed, and the notification is skipped only when the MOODLEID1_ cookie shows the same user logging in again. CVE not yet assigned | MDL-87817
    • Limitation: Moodle 4.3 still protects the MOODLEID1_ cookie with RC4. Upstream moved it to \core\encryption in 4.5 through MDL-81940, a non-security change that is not backported, so the same-user check is weaker than upstream's.
  • MSA-26-0040 - Report builder user filters and columns did not respect profile field visibility (visibility is now checked in the system context). CVE not yet assigned | MDL-87518
  • MSA-26-0039 - Minor XSS via password reset link (username escaped in the reset confirmation email and the password-set form). CVE not yet assigned | MDL-88335
  • MSA-26-0035 - Manual enrolment did not observe the plugin's disabled state (enrol/manual/manage.php now throws when enrol_manual is disabled). CVE not yet assigned | MDL-88593
  • MSA-26-0034 - XSS in forum post templates (the post subject is escaped into a label property instead of being interpolated into a string argument). CVE not yet assigned | MDL-88981
  • MSA-26-0033 - Arbitrary class instantiation via report builder audience classname (only audience base subclasses are accepted). CVE not yet assigned | MDL-89078

4.3.4

Released Oct 1, 2026
CVE-2026-58347
CVE-2026-58345
CVE-2026-58340
CVE-2026-58336
CVE-2026-58334
117 More
Full Version: 
4.3.4+4.3.3:iomad

Notes

  • Initial NES for IOMAD release, forked from IOMAD 4.3.3, which is built on Moodle 4.3.
  • Because IOMAD 4.3.3 predates the final upstream Moodle 4.3 release, this release carries two bodies of security fixes: the Moodle advisories published between 4.3.4 and 4.3.12 that the IOMAD 4.3.3 base never received, and every applicable advisory published after 4.3.12.
  • 122 advisories in total, covering 122 assigned CVEs.
  • Includes fixes for vulnerabilities in third-party libraries vendored into core (ADOdb, FPDI), patched in place.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.4+4.3.3:iomad

Install this release with the installation guide, including the database update. IOMAD does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20260622 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.4+4.3.3 (Build: 20260622)
Core $version2023100904.01
local_iomad $plugin->version2026062200

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0028 - DoS via overlong user profile description (length validation). CVE-2026-58347 | MDL-87898
  • MSA-26-0026 - Missing capability check in assignment marker allocation. CVE-2026-58345 | MDL-88529
  • MSA-26-0021 - CSRF and XSS in grade item idnumber editing. CVE-2026-58340 | MDL-88542
  • MSA-26-0017 - IDOR allows arbitrary comment deletion (strict load before delete). CVE-2026-58336 | MDL-88619
  • MSA-26-0015 - RCE via admin presets import (strengthen import/apply validation). CVE-2026-58334 | MDL-88735
  • MSA-26-0014 - Arbitrary file read in backup restore. File record data is now validated. CVE-2026-58333 | MDL-88736
  • MSA-26-0013 - Email-based MFA bypass (improve Email factor validation). CVE-2026-58332 | MDL-88767
  • MSA-26-0012 - Arbitrary file read in Database activity module (check zip content; clean CSV filenames). CVE-2026-58331 | MDL-88595
  • MSA-26-0006 - RCE via Google Drive repository plugin (prepared file path must be a name only). CVE-2026-7275 | MDL-88423
  • MSA-26-0005 - SQL injection in external database authentication (auth_db). String interpolation is replaced with parameterized queries across the login, user lookup, user existence, and user update paths. CVE-2026-7274 | MDL-88138
  • MSA-26-0003 - DoS in TeX formula editor (mimetex timeout handling). CVE-2026-26047 | MDL-86785
  • MSA-26-0002 - Remote code execution via the TeX filter admin setting. The background argument in filter/tex/latex.php is escaped and the setting is moved to the colour picker. Colour-picker validation is now anchored, so a value is no longer accepted merely for containing a colour - this hardens every colour-picker setting, not only the TeX one. CVE-2026-26046 | MDL-87870 | MDL-87843
  • MSA-26-0001 - RCE via file restore (safer unserializing of repository file source data). CVE-2026-26045 | MDL-87612
  • MSA-25-0059 - Reflected XSS in the policy tool via PARAM_LOCALURL. The javascript: pattern in clean_param() is strengthened. CVE-2025-67855 | MDL-86544
    • Behaviour change: the new pattern matches javascript as a whole word anywhere before a : or /, so a relative local URL that merely contains the word is now cleaned to an empty string - for example docs/javascript/index.html. Root-relative and wwwroot-absolute URLs return before the check and are unaffected, and matching is whole-word only, so docs/javascripts/index.html still passes. Sites that route such relative paths through PARAM_LOCALURL must make them root-relative or use a different param type. This is upstream's own trade-off, not a porting artefact.
  • MSA-25-0055 - Formula injection when exporting to CSV/Excel/ODS (escape leading =,+,-,@ and control chars in dataformat and grade exports). CVE-2025-67851 | MDL-72744
  • MSA-25-0054 - XSS in the formula (equation) editor preview. Input is sanitised in both atto_equation and tiny_equation. CVE-2025-67850 | MDL-85557
  • MSA-25-0052 - Authentication via LTI Provider available to suspended users (block suspended accounts in legacy LTI and LTI 1.3 auth). CVE-2025-67848 | MDL-87286
  • MSA-25-0051 - RCE via file restore: use the safe unserialize_object() helper instead of raw @unserialize() on stored-file source data in lib/filelib.php and repository/draftfiles_ajax.php, preventing PHP object injection during draft-file save/restore. CVE-2025-67847 | MDL-87353
  • MSA-25-0047 - MFA bypass via mfa_pending NO_REDIRECT path. CVE-2025-62398 | MDL-86334
  • MSA-25-0042 - Exception handling in bundled FPDI PDF library. CVE-2025-54869 | MDL-86353
  • MSA-25-0035 - Missing authorisation checks in BigBlueButton view page. CVE-2025-49517 | MDL-84706
  • MSA-25-0033 - Course visibility not honoured consistently. CVE-2025-49515 | MDL-84518
  • MSA-25-0032 - SSRF via DNS rebind (bind resolved IPs/ports for cURL). CVE-2025-49514 | MDL-83762
  • MSA-25-0031 - SQL escaping in the bundled ADOdb PostgreSQL driver. CVE-2025-46337 | MDL-85375
  • MSA-25-0025 - Reflected XSS in the policy tool via PARAM_LOCALURL. Aligns the clean_param() block with the Moodle tree; the security substance is covered by the stronger MSA-25-0059 fix. CVE-2025-3643 | MDL-85104
  • MSA-25-0024 - Authenticated RCE in EQUELLA repository (safer unserialize). CVE-2025-3642 | MDL-84473
  • MSA-25-0023 - Authenticated RCE in Dropbox repository (safer unserialize). CVE-2025-3641 | MDL-84475
  • MSA-25-0014 - User DoS and name disclosure via IDOR in MFA email factor revoke. CVE-2025-3625 | MDL-85015
  • MSA-25-0013 - RCE via bundled MimeTeX binary (filter/tex mimetex). CVE-2024-40446 | MDL-85152
  • MSA-25-0010 - SQL injection in course search module list filter. CVE-2025-26533 | MDL-84271
  • MSA-25-0006 - Reflected XSS via question bank filter. CVE-2025-26530 | MDL-84146
  • MSA-25-0005 - Stored XSS in admin live log. CVE-2025-26529 | MDL-84145
  • MSA-25-0001 - Arbitrary file read through pdfTeX. CVE-2025-26525 | MDL-84136
  • MSA-24-0056 - DoS due to guest sessions' longer timeout period. CVE-2024-55648 | MDL-61316
  • MSA-24-0055 - Reflected XSS in question bank filter. CVE-2024-55647 | MDL-83357
  • MSA-24-0051 - Unprotected access to sensitive info via learning plan web service. CVE-2024-55643 | MDL-83921
  • MSA-24-0042 - Unprotected access to sensitive info via dynamic tables. CVE-2024-45689 | MDL-82567
  • MSA-24-0041 - LFI when restoring malformed block backups. CVE-2024-43440 | MDL-82392
  • MSA-24-0040 - Reflected XSS via H5P error message. CVE-2024-43439 | MDL-82558
  • MSA-24-0037 - Site administration SQL injection via XMLDB editor. CVE-2024-43436 | MDL-82395
  • MSA-24-0035 - CSRF in Feedback non-respondents report. CVE-2024-43434 | MDL-82262
  • MSA-24-0032 - IDOR in badges allows deletion of arbitrary badges. CVE-2024-43431 | MDL-82390
  • MSA-24-0029 - Cache poisoning via injection into storage. Session and local storage keys are now validated. CVE-2024-43428 | MDL-81718
  • MSA-24-0027 - Arbitrary file read through pdfTeX. CVE-2024-43426 | MDL-82745
  • MSA-24-0026 - RCE via calculated question types (formula regex hardening). CVE-2024-43425 | MDL-82576
  • MSA-24-0024 - CSRF risks due to misuse of confirm_sesskey. CVE-2024-38276 | MDL-81890
  • MSA-24-0016 - Authenticated LFI via modified mod_data backup. CVE-2024-34005 | MDL-81267
  • MSA-24-0015 - Authenticated LFI via modified mod_wiki backup. CVE-2024-34004 | MDL-81284
  • MSA-24-0014 - Authenticated LFI via modified mod_workshop backup. CVE-2024-34003 | MDL-80712
  • MSA-24-0013 - Authenticated LFI via modified mod_feedback backup. CVE-2024-34002 | MDL-81135
  • MSA-24-0007 - Broken access control when setting calendar event type. CVE-2024-33996 | MDL-81247
Minor

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.