Moodle 4.3.x Release Notes

Notes

• Initial NES for Moodle release, forked from upstream Moodle 4.3.12 - the final upstream 4.3.x release.
• Backports every Moodle security advisory published after Moodle 4.3.12 that applies to the 4.3 line: 49 advisories, covering 31 assigned CVEs. The remaining 18 advisories have no CVE assigned by Moodle at the time of release; this page is updated as identifiers are published.
• Includes fixes for vulnerabilities in third-party libraries vendored into Moodle core (ADOdb, FPDI), patched in place.
• $branch remains 403 and $maturity remains MATURITY_STABLE, so Moodle 4.3 compatibility is unchanged.

Full Version: 4.3.13+4.3.12:moodle

Use these values to verify your installation. Build: 20260618 is the date this build was cut, not its release date.

Security Fixes

Severity follows Moodle's own rating for each advisory, as published in the Moodle security advisories.

Serious

• MSA-26-0028 - DoS via overlong user profile description (length validation). CVE not yet assigned | MDL-87898
• MSA-26-0026 - Missing capability check in assignment marker allocation. CVE not yet assigned | MDL-88529
• MSA-26-0021 - CSRF and XSS in grade item idnumber editing. CVE not yet assigned | MDL-88542
• MSA-26-0017 - IDOR allows arbitrary comment deletion (strict load before delete). CVE not yet assigned | MDL-88619
• MSA-26-0015 - RCE via admin presets import (strengthen import/apply validation). CVE not yet assigned | MDL-88735
• MSA-26-0014 - Arbitrary file read in backup restore. File record data is now validated. CVE not yet assigned | MDL-88736
• MSA-26-0013 - Email-based MFA bypass (improve Email factor validation). CVE not yet assigned | MDL-88767
• MSA-26-0012 - Arbitrary file read in Database activity module (check zip content; clean CSV filenames). CVE not yet assigned | MDL-88595
• MSA-26-0006 - RCE via Google Drive repository plugin (prepared file path must be a name only). CVE-2026-7275 | MDL-88423
• MSA-26-0005 - SQL injection in external database authentication (auth_db). String interpolation is replaced with parameterized queries across the login, user lookup, user existence, and user update paths. CVE-2026-7274 | MDL-88138
• MSA-26-0003 - DoS in TeX formula editor (mimetex timeout handling). CVE-2026-26047 | MDL-86785
• MSA-26-0002 - Remote code execution via the TeX filter admin setting. The background argument in filter/tex/latex.php is escaped and the setting is moved to the colour picker. Colour-picker validation is now anchored, so a value is no longer accepted merely for containing a colour - this hardens every colour-picker setting, not only the TeX one. CVE-2026-26046 | MDL-87870 | MDL-87843
• MSA-26-0001 - RCE via file restore (safer unserializing of repository file source data). CVE-2026-26045 | MDL-87612
• MSA-25-0059 - Reflected XSS in the policy tool via PARAM_LOCALURL. The javascript: pattern in clean_param() is strengthened. CVE-2025-67855 | MDL-86544
  • Behaviour change: the new pattern matches javascript as a whole word anywhere before a : or /, so a relative local URL that merely contains the word is now cleaned to an empty string - for example docs/javascript/index.html. Root-relative and wwwroot-absolute URLs return before the check and are unaffected, and matching is whole-word only, so docs/javascripts/index.html still passes. Sites that route such relative paths through PARAM_LOCALURL must make them root-relative or use a different param type. This is upstream's own trade-off, not a porting artefact.
• MSA-25-0055 - Formula injection when exporting to CSV/Excel/ODS (escape leading =,+,-,@ and control chars in dataformat and grade exports). CVE-2025-67851 | MDL-72744
• MSA-25-0054 - XSS in the formula (equation) editor preview. Input is sanitised in both atto_equation and tiny_equation. CVE-2025-67850 | MDL-85557
• MSA-25-0052 - Authentication via LTI Provider available to suspended users (block suspended accounts in legacy LTI and LTI 1.3 auth). CVE-2025-67848 | MDL-87286
• MSA-25-0051 - Remote code execution via file restore. Stored-file source data is now read with the safe unserialize_object() helper instead of raw @unserialize(), preventing PHP object injection during draft-file save and restore. CVE-2025-67847 | MDL-87353
• MSA-25-0047 - MFA bypass via mfa_pending NO_REDIRECT path. CVE-2025-62398 | MDL-86334
• MSA-25-0042 - Exception handling in bundled FPDI PDF library. CVE-2025-54869 | MDL-86353
• MSA-25-0035 - Missing authorisation checks in BigBlueButton view page. CVE-2025-49517 | MDL-84706
• MSA-25-0033 - Course visibility not honoured consistently. CVE-2025-49515 | MDL-84518
• MSA-25-0032 - SSRF via DNS rebind (bind resolved IPs/ports for cURL). CVE-2025-49514 | MDL-83762
• MSA-25-0031 - SQL escaping in the bundled ADOdb PostgreSQL driver. CVE-2025-46337 | MDL-85375

Minor

• MSA-26-0029 - Report builder fragment callbacks missing access checks (verify can-view/can-edit and audience add permission in filters/audience form fragments). CVE not yet assigned | MDL-84535
• MSA-26-0027 - Blind SSRF in MNet peers function (validate peer hostname). CVE not yet assigned | MDL-87911
• MSA-26-0023 - CSRF when adding quiz section headings (sesskey protection). CVE not yet assigned | MDL-88540
• MSA-26-0022 - CSRF in group messaging state toggle (require_sesskey on enable/disablemessaging; sesskey field in groups index template). CVE not yet assigned | MDL-88541
• MSA-26-0020 - Reflected XSS via Feedback import error message (stricter cleaning). CVE not yet assigned | MDL-88543
• MSA-26-0019 - CSRF in user profile page reset (sesskey check). CVE not yet assigned | MDL-88545
• MSA-26-0018 - CSRF in user homepage preference setting (sesskey check on setdefaulthome in index.php and my/index.php). CVE not yet assigned | MDL-88609
• MSA-26-0016 - Missing group-mode access checks in grade web services. CVE not yet assigned | MDL-88667
• MSA-26-0011 - CSRF and missing capability check in admin/mnet/peers.php. CVE not yet assigned | MDL-84495
• MSA-26-0007 - Messaging DoS from messages of deleted users (validation). CVE not yet assigned | MDL-87760
• MSA-25-0061 - User IDs exposed in URLs with anonymous assignment submissions (use blind id instead of userid in grading table and submission removal). CVE-2025-67857 | MDL-82808
• MSA-25-0060 - Badges with role criterion awarded to users without the role. CVE-2025-67856 | MDL-86507
• MSA-25-0058 - Participants can access ratings without permission. View and view-all rating permissions are now enforced in Forum, Database, and Glossary. CVE-2025-67854 | MDL-86960
• MSA-25-0057 - Password brute force via confirmation-email web service (validation). CVE-2025-67853 | MDL-86326
• MSA-25-0056 - Open redirect in OAuth2 login (restrict redirect to local URLs). CVE-2025-67852 | MDL-80317
• MSA-25-0050 - Bypass timer in timed assignments (respect timer server-side in submission flow). CVE-2025-62401 | MDL-75087
• MSA-25-0049 - Hidden group names visible via group calendar events (event form shows only accessible groups). CVE-2025-62400 | MDL-86261
• MSA-25-0048 - Password brute force via web service auth (stricter login check). CVE-2025-62399 | MDL-86327
• MSA-25-0044 - External cohort search web service leaks system cohort data. CVE-2025-62395 | MDL-85421
• MSA-25-0040 - Profile-access callbacks not enforced in web services (user_get_user_details now runs control_view_profile callbacks; new user_process_profile_callbacks). CVE-2025-62438 | MDL-63395
• MSA-25-0039 - Feedback results ignored Separate Groups mode (new mod_feedback manager::can_see_others_in_groups gate on entries/non-respondents). CVE-2025-62437 | MDL-84463
• MSA-25-0038 - Course Logs / Live Logs reports ignored Separate Groups mode (hide report for teachers without groups; new report_helper::has_valid_group). CVE-2025-62436 | MDL-84464
• MSA-25-0036 - IDOR: fetch other users' recently accessed courses via web service (require moodle/user:viewalldetails). CVE-2025-49518 | MDL-79993
• MSA-25-0034 - CSRF in badges backpack management (add sesskey checks). CVE-2025-49516 | MDL-84497
• MSA-25-0030 - Password revealed on login page after logout (login-page caching). CVE-2025-49513 | MDL-85323