CVE-2025-26525

Arbitrary file read risk through pdfTeX

State: Published
Severity: 8.6 High
Published: Feb 24, 2025
Updated: Feb 24, 2025
Reserved: Feb 12, 2025

Description

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	fedora

Weaknesses

CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
moodleMoodle Project	4.5.0 to before 4.5.2Affected 4.4.0 to before 4.4.6Affected 4.3.0 to before 4.3.10Affected 4.1.0 to before 4.1.16Affected 4.2.0 to before 4.2.Unknown before 4.0.Unknown

References

https://moodle.org/mod/forum/discuss.php?d=466141vendor-advisory
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.