CVE-2025-26525

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed).

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Moodle Project	moodle	>= 4.5.0, < 4.5.2; >= 4.4.0, < 4.4.6; >= 4.3.0, < 4.3.10; >= 4.1.0, < 4.1.16

References

Timeline

Published: Feb 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-265266.5Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback ac CVE-2025-265275.3Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.CVE-2025-265286.1The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.CVE-2025-265296.1Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.CVE-2025-26534.3A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulati CVE-2025-265306.1The question bank filter required additional sanitizing to prevent a reflected XSS risk.CVE-2025-265315.3Insufficient capability checks made it possible to disable badges a user does not have permission to access.CVE-2025-265324.3Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.CVE-2025-265339.8An SQL injection risk was identified in the module list filter within course search.CVE-2025-265348.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows Path CVE-2025-265359.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gat CVE-2025-265367.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar