CVE-2025-26533 is a High severity SQL injection flaw (CVSS 8.1) in Moodle. It sits in the module list filter within course search, tracked as MDL-84271. The record does not list affected or fixed versions, so read the Moodle security announcement and upgrade to a release that includes the fix.
What's affected
- Product: Moodle, the open source learning management system
- Affected component: the module list filter within course search
- Tracker: MDL-84271
- Versions: not listed in the record. Check the Moodle announcement for the branches and releases
I want to be honest about what is known. The record gives one sentence, an SQL injection risk in the module list filter within course search. The Moodle forum announcement linked from the record blocked my automated fetch with a challenge page, and the project code search page did not give a version list. I therefore cannot name affected or fixed versions here, and I am not going to guess them.
The vector shows a network attack with high complexity and no privileges needed, with high impact on confidentiality, integrity and availability. High complexity brings the score down from the higher numbers seen for simple flaws.
How to check if you're exposed
Find the version of your Moodle site. On the server, the release is set in the version file of the Moodle root:
grep release /var/www/moodle/version.php
You can also see it in Site administration, under the notifications page. Then open the Moodle security announcement for this issue and compare your release with the fixed releases for your branch.
Also check whether course search is reachable by users who are not logged in. Some sites allow a guest to browse courses, and the vector in the record says no privileges are needed.
What to do now
- Read the Moodle security announcement for MDL-84271 and note the fixed release for your branch.
- Upgrade to that release or later. Moodle publishes fixes for supported branches, so if your branch is no longer supported, plan a move to a supported one.
- Make sure the database account used by Moodle has only the permissions it needs.
- Review web server logs for unusual requests to course search pages.
- If you run plugins that extend course search, check with their authors whether they build queries from the filter input.
Why it matters
The weakness is CWE-89 (SQL injection). A filter in a search feature turned user input into part of a database query without safe handling. Search and filter code is a common source of this bug, because the input is free form and there are many options to combine.
Moodle holds student records, grades, and often staff data, so the database is a valuable target. Schools and universities run large public sites, and many run versions that are a few releases behind. The record does not say the flaw is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
For a platform with many installs, a fixed release is only useful once it is applied. Track your Moodle version in your inventory like any other dependency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Moodle versions fix CVE-2025-26533?
The record does not list them, and I could not read the announcement. Check the Moodle security announcement and the MDL-84271 tracker for the releases by branch.
Is a login needed to reach the flaw?
The CVSS vector lists no privileges required. Whether course search is open to guests on your site is a setting you should check.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
