Moodle: Teachers can evade trusttext config when restoring glossary entries (CVE-2025-26532)
A vulnerability in Moodle allows teachers to bypass the trusttext configuration when restoring glossary entries. This issue occurs because additional checks were needed to ensure that trusttext is properly applied during the restoration process. The vulnerability affects multiple Moodle versions prior to their respective patches. A fix is available to address this issue.
AI Analysis
Technical Summary
The vulnerability in Moodle (CVE-2025-26532) involves insufficient enforcement of the trusttext setting when teachers restore glossary entries. Trusttext is a security feature that controls which HTML tags and attributes are allowed in user-submitted content. Due to missing checks, teachers could restore glossary entries that circumvent the trusttext restrictions, potentially allowing disallowed content. This issue affects Moodle versions 4.1.0 through 4.1.15, 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The vulnerability has been patched as per the Moodle git repository commit MDL-84003.
Potential Impact
The impact is a medium-severity security issue where teachers can bypass content filtering controls (trusttext) when restoring glossary entries. This could allow the inclusion of HTML or other content that would normally be restricted, potentially leading to content injection risks within the glossary feature. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied to affected Moodle versions. The fix ensures that trusttext checks are properly enforced during glossary entry restoration. Administrators should update Moodle to versions 4.1.16 or later, 4.3.10 or later, 4.4.6 or later, or 4.5.2 or later to remediate this vulnerability.
Moodle: Teachers can evade trusttext config when restoring glossary entries (CVE-2025-26532)
Description
A vulnerability in Moodle allows teachers to bypass the trusttext configuration when restoring glossary entries. This issue occurs because additional checks were needed to ensure that trusttext is properly applied during the restoration process. The vulnerability affects multiple Moodle versions prior to their respective patches. A fix is available to address this issue.
Affected software
pkg:bitnami/moodleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Moodle (CVE-2025-26532) involves insufficient enforcement of the trusttext setting when teachers restore glossary entries. Trusttext is a security feature that controls which HTML tags and attributes are allowed in user-submitted content. Due to missing checks, teachers could restore glossary entries that circumvent the trusttext restrictions, potentially allowing disallowed content. This issue affects Moodle versions 4.1.0 through 4.1.15, 4.3.0 through 4.3.9, 4.4.0 through 4.4.5, and 4.5.0 through 4.5.1. The vulnerability has been patched as per the Moodle git repository commit MDL-84003.
Potential Impact
The impact is a medium-severity security issue where teachers can bypass content filtering controls (trusttext) when restoring glossary entries. This could allow the inclusion of HTML or other content that would normally be restricted, potentially leading to content injection risks within the glossary feature. There are no known exploits in the wild at this time.
Mitigation Recommendations
A patch is available and should be applied to affected Moodle versions. The fix ensures that trusttext checks are properly enforced during glossary entry restoration. Administrators should update Moodle to versions 4.1.16 or later, 4.3.10 or later, 4.4.6 or later, or 4.5.2 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2025-26532
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2025-26532"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Patch Information
Threat ID: 6aa00610acd9273b49ab7384
Added to database: 09/08/2026, 12:56:48 UTC
Last enriched: 09/08/2026, 13:41:13 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.