ANSSI Warns of Multiple Moodle Vulnerabilities
Moodle versions before 4.5.13, 5.0.9, 5.1.6 and 5.2.2 contain multiple flaws enabling data exposure, XSS, and CSRF attacks.
ANSSI (France's national CERT) published an advisory detailing multiple vulnerabilities in Moodle, a widely used open-source learning management system (LMS), affecting versions 4.5.x prior to 4.5.13, 5.0.x prior to 5.0.9, 5.1.x prior to 5.1.6, and 5.2.x prior to 5.2.2. The vulnerabilities span several categories: unauthorized access to confidential data, security policy bypass, reflected/indirect cross-site scripting (XSS), and cross-site request forgery (CSRF) allowing illegitimate request injection. The specific technical mechanisms have not been detailed by the vendor.
No evidence of active exploitation in the wild is mentioned in this advisory. The bulletin references ten separate Moodle security forum disclosures (dated 9 September 2026) without providing individual CVE identifiers, indicating a batch of distinct issues patched simultaneously by the Moodle project.
Defenders operating Moodle instances — commonly deployed across educational institutions, universities, and corporate training platforms — should prioritize upgrading to the fixed versions (4.5.13, 5.0.9, 5.1.6, or 5.2.2 or later) referenced in the vendor's official bulletins. Given the mix of data confidentiality, XSS, and CSRF issues, organizations should also review session handling, input sanitization on user-facing forms, and access controls for sensitive data endpoints as part of remediation validation.
Detection guidance
Moodle XSS Payload in HTTP Request Parameters
Detects JavaScript payloads in HTTP request parameters targeting Moodle instances, consistent with reflected/stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Moodle XSS Payload in HTTP Request Parameters
description: Detects common JavaScript XSS payloads in HTTP GET/POST parameters targeting
Moodle endpoints. Matches reflected or stored XSS attack patterns without requiring
specific CVE identifiers.
tags:
- attack.execution
- attack.t1059.007
logsource:
category: proxy
product: http_proxy
detection:
selection_moodle_path:
uri|contains:
- /moodle/
- /course/
- /mod/
- /user/
- /message/
selection_xss_payload:
query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- onclick=
- alert(
- eval(
OR: []
condition: selection_moodle_path and selection_xss_payload
falsepositives:
- Security scanners (Burp, OWASP ZAP) performing authorized XSS testing against internal
Moodle instances
- Legitimate user-submitted HTML content if Moodle is misconfigured to allow inline
scripts
level: high
id: e3d80aaf-3015-5d3e-ad42-3cf986c63cb5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1155
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free