GHSA-c5cj-xp43-qcc3

Moodle's error handling leads to sensitive information disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-62396

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	moodle/moodle	>= 5.0.0-beta, < 5.0.3	5.0.3
Packagist	moodle/moodle	>= 4.5.0-beta, < 4.5.7	4.5.7

Details

As written in the advisory (Markdown source, shown as plain text).

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-62396 advisory
https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e web
https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce web
https://access.redhat.com/security/cve/CVE-2025-62396 web
https://bugzilla.redhat.com/show_bug.cgi?id=2404429 web
https://github.com/moodle/moodle package
https://moodle.org/mod/forum/discuss.php?d=470385 web