HeroDevs
Visit NES for IOMAD Home Page

IOMAD 4.3.x Release Notes

3 versions

Comprehensive release notes and changelog for IOMAD 4.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Nov 4, 2026
Latest: 4.3.6
122 Patched Vulnerabilities
VEX Statements

November 2026

4.3.6

Released Nov 4, 2026
Full Version: 
4.3.6+4.3.3:iomad

Notes

  • Backports 1 advisory published since NES for IOMAD 4.3.5 that applies to the 4.3 line. It has no CVE assigned by Moodle at the time of release; this page is updated when the identifier is published.
  • The 11 advisories in 4.3.5 still have no CVE assigned by Moodle.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.6+4.3.3:iomad

Install this release with the installation guide, including the database update. IOMAD does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20261103 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.6+4.3.3 (Build: 20261103)
Core $version2023100906.00
local_iomad $plugin->version2026110300

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0044 - Missing access checks on H5P content files. core_h5p_pluginfile now checks the content and export file areas against the original .h5p package context, packages in the system context require login and refuse guests, the showdescription exemption applies to the intro file area only, and exports are served only while "Allow download" is enabled. CVE not yet assigned | MDL-89547

October 2026

4.3.5

Released Oct 12, 2026
Full Version: 
4.3.5+4.3.3:iomad

Notes

  • Backports 11 advisories published since NES for IOMAD 4.3.4 that apply to the 4.3 line. None has a CVE assigned by Moodle at the time of release; this page is updated as identifiers are published.
  • CVEs are now assigned to the 18 advisories in 4.3.4 that had none at its release, and those entries below are updated.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.5+4.3.3:iomad

Install this release with the installation guide, including the database update. IOMAD does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20261008 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.5+4.3.3 (Build: 20261008)
Core $version2023100905.00
local_iomad $plugin->version2026100800

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0042 - Blind SQL injection in profile availability condition (reject standard field names not in the allowlist). CVE not yet assigned | MDL-89484
  • MSA-26-0041 - CSRF in XML grade imports. import.php now rejects direct access outside key login, and interactive imports run from the sesskey-protected form. CVE not yet assigned | MDL-84545
  • MSA-26-0032 - User profile information disclosure via grade web service (get_gradable_users now requires moodle/site:viewuseridentity instead of moodle/course:viewparticipants). CVE not yet assigned | MDL-89381
  • MSA-26-0031 - SQL injection in question bank web service (entryid is cleaned as an integer and bound as a query parameter). CVE not yet assigned | MDL-89383
  • MSA-26-0030 - SSRF in URL downloader via IPv4-mapped IPv6 addresses (address_in_subnet() also checks the unwrapped IPv4 form against the blocked-hosts list). CVE not yet assigned | MDL-88779
Minor
  • MSA-26-0043 - Login notification bypass via spoofed Moodle App user agent. The user-agent exemption is removed, and the notification is skipped only when the MOODLEID1_ cookie shows the same user logging in again. CVE not yet assigned | MDL-87817
    • Limitation: Moodle 4.3 still protects the MOODLEID1_ cookie with RC4. Upstream moved it to \core\encryption in 4.5 through MDL-81940, a non-security change that is not backported, so the same-user check is weaker than upstream's.
  • MSA-26-0040 - Report builder user filters and columns did not respect profile field visibility (visibility is now checked in the system context). CVE not yet assigned | MDL-87518
  • MSA-26-0039 - Minor XSS via password reset link (username escaped in the reset confirmation email and the password-set form). CVE not yet assigned | MDL-88335
  • MSA-26-0035 - Manual enrolment did not observe the plugin's disabled state (enrol/manual/manage.php now throws when enrol_manual is disabled). CVE not yet assigned | MDL-88593
  • MSA-26-0034 - XSS in forum post templates (the post subject is escaped into a label property instead of being interpolated into a string argument). CVE not yet assigned | MDL-88981
  • MSA-26-0033 - Arbitrary class instantiation via report builder audience classname (only audience base subclasses are accepted). CVE not yet assigned | MDL-89078

4.3.4

Released Oct 1, 2026
CVE-2026-58347
CVE-2026-58345
CVE-2026-58340
CVE-2026-58336
CVE-2026-58334
117 More
Full Version: 
4.3.4+4.3.3:iomad

Notes

  • Initial NES for IOMAD release, forked from IOMAD 4.3.3, which is built on Moodle 4.3.
  • Because IOMAD 4.3.3 predates the final upstream Moodle 4.3 release, this release carries two bodies of security fixes: the Moodle advisories published between 4.3.4 and 4.3.12 that the IOMAD 4.3.3 base never received, and every applicable advisory published after 4.3.12.
  • 122 advisories in total, covering 122 assigned CVEs.
  • Includes fixes for vulnerabilities in third-party libraries vendored into core (ADOdb, FPDI), patched in place.
  • $branch remains 403 and $maturity remains MATURITY_STABLE, so IOMAD 4.3 compatibility is unchanged.

Full Version: 4.3.4+4.3.3:iomad

Install this release with the installation guide, including the database update. IOMAD does not record the new $version until the update runs.

Use these values to verify your installation. Build: 20260622 is the date this build was cut, not its release date.

CheckValue
Core $release4.3.4+4.3.3 (Build: 20260622)
Core $version2023100904.01
local_iomad $plugin->version2026062200

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious
  • MSA-26-0028 - DoS via overlong user profile description (length validation). CVE-2026-58347 | MDL-87898
  • MSA-26-0026 - Missing capability check in assignment marker allocation. CVE-2026-58345 | MDL-88529
  • MSA-26-0021 - CSRF and XSS in grade item idnumber editing. CVE-2026-58340 | MDL-88542
  • MSA-26-0017 - IDOR allows arbitrary comment deletion (strict load before delete). CVE-2026-58336 | MDL-88619
  • MSA-26-0015 - RCE via admin presets import (strengthen import/apply validation). CVE-2026-58334 | MDL-88735
  • MSA-26-0014 - Arbitrary file read in backup restore. File record data is now validated. CVE-2026-58333 | MDL-88736
  • MSA-26-0013 - Email-based MFA bypass (improve Email factor validation). CVE-2026-58332 | MDL-88767
  • MSA-26-0012 - Arbitrary file read in Database activity module (check zip content; clean CSV filenames). CVE-2026-58331 | MDL-88595
  • MSA-26-0006 - RCE via Google Drive repository plugin (prepared file path must be a name only). CVE-2026-7275 | MDL-88423
  • MSA-26-0005 - SQL injection in external database authentication (auth_db). String interpolation is replaced with parameterized queries across the login, user lookup, user existence, and user update paths. CVE-2026-7274 | MDL-88138
  • MSA-26-0003 - DoS in TeX formula editor (mimetex timeout handling). CVE-2026-26047 | MDL-86785
  • MSA-26-0002 - Remote code execution via the TeX filter admin setting. The background argument in filter/tex/latex.php is escaped and the setting is moved to the colour picker. Colour-picker validation is now anchored, so a value is no longer accepted merely for containing a colour - this hardens every colour-picker setting, not only the TeX one. CVE-2026-26046 | MDL-87870 | MDL-87843
  • MSA-26-0001 - RCE via file restore (safer unserializing of repository file source data). CVE-2026-26045 | MDL-87612
  • MSA-25-0059 - Reflected XSS in the policy tool via PARAM_LOCALURL. The javascript: pattern in clean_param() is strengthened. CVE-2025-67855 | MDL-86544
    • Behaviour change: the new pattern matches javascript as a whole word anywhere before a : or /, so a relative local URL that merely contains the word is now cleaned to an empty string - for example docs/javascript/index.html. Root-relative and wwwroot-absolute URLs return before the check and are unaffected, and matching is whole-word only, so docs/javascripts/index.html still passes. Sites that route such relative paths through PARAM_LOCALURL must make them root-relative or use a different param type. This is upstream's own trade-off, not a porting artefact.
  • MSA-25-0055 - Formula injection when exporting to CSV/Excel/ODS (escape leading =,+,-,@ and control chars in dataformat and grade exports). CVE-2025-67851 | MDL-72744
  • MSA-25-0054 - XSS in the formula (equation) editor preview. Input is sanitised in both atto_equation and tiny_equation. CVE-2025-67850 | MDL-85557
  • MSA-25-0052 - Authentication via LTI Provider available to suspended users (block suspended accounts in legacy LTI and LTI 1.3 auth). CVE-2025-67848 | MDL-87286
  • MSA-25-0051 - RCE via file restore: use the safe unserialize_object() helper instead of raw @unserialize() on stored-file source data in lib/filelib.php and repository/draftfiles_ajax.php, preventing PHP object injection during draft-file save/restore. CVE-2025-67847 | MDL-87353
  • MSA-25-0047 - MFA bypass via mfa_pending NO_REDIRECT path. CVE-2025-62398 | MDL-86334
  • MSA-25-0042 - Exception handling in bundled FPDI PDF library. CVE-2025-54869 | MDL-86353
  • MSA-25-0035 - Missing authorisation checks in BigBlueButton view page. CVE-2025-49517 | MDL-84706
  • MSA-25-0033 - Course visibility not honoured consistently. CVE-2025-49515 | MDL-84518
  • MSA-25-0032 - SSRF via DNS rebind (bind resolved IPs/ports for cURL). CVE-2025-49514 | MDL-83762
  • MSA-25-0031 - SQL escaping in the bundled ADOdb PostgreSQL driver. CVE-2025-46337 | MDL-85375
  • MSA-25-0025 - Reflected XSS in the policy tool via PARAM_LOCALURL. Aligns the clean_param() block with the Moodle tree; the security substance is covered by the stronger MSA-25-0059 fix. CVE-2025-3643 | MDL-85104
  • MSA-25-0024 - Authenticated RCE in EQUELLA repository (safer unserialize). CVE-2025-3642 | MDL-84473
  • MSA-25-0023 - Authenticated RCE in Dropbox repository (safer unserialize). CVE-2025-3641 | MDL-84475
  • MSA-25-0014 - User DoS and name disclosure via IDOR in MFA email factor revoke. CVE-2025-3625 | MDL-85015
  • MSA-25-0013 - RCE via bundled MimeTeX binary (filter/tex mimetex). CVE-2024-40446 | MDL-85152
  • MSA-25-0010 - SQL injection in course search module list filter. CVE-2025-26533 | MDL-84271
  • MSA-25-0006 - Reflected XSS via question bank filter. CVE-2025-26530 | MDL-84146
  • MSA-25-0005 - Stored XSS in admin live log. CVE-2025-26529 | MDL-84145
  • MSA-25-0001 - Arbitrary file read through pdfTeX. CVE-2025-26525 | MDL-84136
  • MSA-24-0056 - DoS due to guest sessions' longer timeout period. CVE-2024-55648 | MDL-61316
  • MSA-24-0055 - Reflected XSS in question bank filter. CVE-2024-55647 | MDL-83357
  • MSA-24-0051 - Unprotected access to sensitive info via learning plan web service. CVE-2024-55643 | MDL-83921
  • MSA-24-0042 - Unprotected access to sensitive info via dynamic tables. CVE-2024-45689 | MDL-82567
  • MSA-24-0041 - LFI when restoring malformed block backups. CVE-2024-43440 | MDL-82392
  • MSA-24-0040 - Reflected XSS via H5P error message. CVE-2024-43439 | MDL-82558
  • MSA-24-0037 - Site administration SQL injection via XMLDB editor. CVE-2024-43436 | MDL-82395
  • MSA-24-0035 - CSRF in Feedback non-respondents report. CVE-2024-43434 | MDL-82262
  • MSA-24-0032 - IDOR in badges allows deletion of arbitrary badges. CVE-2024-43431 | MDL-82390
  • MSA-24-0029 - Cache poisoning via injection into storage. Session and local storage keys are now validated. CVE-2024-43428 | MDL-81718
  • MSA-24-0027 - Arbitrary file read through pdfTeX. CVE-2024-43426 | MDL-82745
  • MSA-24-0026 - RCE via calculated question types (formula regex hardening). CVE-2024-43425 | MDL-82576
  • MSA-24-0024 - CSRF risks due to misuse of confirm_sesskey. CVE-2024-38276 | MDL-81890
  • MSA-24-0016 - Authenticated LFI via modified mod_data backup. CVE-2024-34005 | MDL-81267
  • MSA-24-0015 - Authenticated LFI via modified mod_wiki backup. CVE-2024-34004 | MDL-81284
  • MSA-24-0014 - Authenticated LFI via modified mod_workshop backup. CVE-2024-34003 | MDL-80712
  • MSA-24-0013 - Authenticated LFI via modified mod_feedback backup. CVE-2024-34002 | MDL-81135
  • MSA-24-0007 - Broken access control when setting calendar event type. CVE-2024-33996 | MDL-81247
Minor

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.