# ANSSI Warns of Multiple Moodle Vulnerabilities

Published: 2026-09-10 · Severity: routine · Sectors: education, technology
Canonical: https://vorant.io/reports/08e63f9e-b4e1-5bee-9296-d38d631c0b4f/anssi-warns-of-multiple-moodle-vulnerabilities

> Moodle versions before 4.5.13, 5.0.9, 5.1.6 and 5.2.2 contain multiple flaws enabling data exposure, XSS, and CSRF attacks.

ANSSI (France's national CERT) published an advisory detailing multiple vulnerabilities in Moodle, a widely used open-source learning management system (LMS), affecting versions 4.5.x prior to 4.5.13, 5.0.x prior to 5.0.9, 5.1.x prior to 5.1.6, and 5.2.x prior to 5.2.2. The vulnerabilities span several categories: unauthorized access to confidential data, security policy bypass, reflected/indirect cross-site scripting (XSS), and cross-site request forgery (CSRF) allowing illegitimate request injection. The specific technical mechanisms have not been detailed by the vendor.

No evidence of active exploitation in the wild is mentioned in this advisory. The bulletin references ten separate Moodle security forum disclosures (dated 9 September 2026) without providing individual CVE identifiers, indicating a batch of distinct issues patched simultaneously by the Moodle project.

Defenders operating Moodle instances — commonly deployed across educational institutions, universities, and corporate training platforms — should prioritize upgrading to the fixed versions (4.5.13, 5.0.9, 5.1.6, or 5.2.2 or later) referenced in the vendor's official bulletins. Given the mix of data confidentiality, XSS, and CSRF issues, organizations should also review session handling, input sanitization on user-facing forms, and access controls for sensitive data endpoints as part of remediation validation.

## Detection guidance (public sample)

### Moodle XSS Payload in HTTP Request Parameters

ATT&CK: T1059.007

Detects JavaScript payloads in HTTP request parameters targeting Moodle instances, consistent with reflected/stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Moodle XSS Payload in HTTP Request Parameters
description: Detects common JavaScript XSS payloads in HTTP GET/POST parameters targeting
  Moodle endpoints. Matches reflected or stored XSS attack patterns without requiring
  specific CVE identifiers.
tags:
- attack.execution
- attack.t1059.007
logsource:
  category: proxy
  product: http_proxy
detection:
  selection_moodle_path:
    uri|contains:
    - /moodle/
    - /course/
    - /mod/
    - /user/
    - /message/
  selection_xss_payload:
    query|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - onclick=
    - alert(
    - eval(
    OR: []
  condition: selection_moodle_path and selection_xss_payload
falsepositives:
- Security scanners (Burp, OWASP ZAP) performing authorized XSS testing against internal
  Moodle instances
- Legitimate user-submitted HTML content if Moodle is misconfigured to allow inline
  scripts
level: high
id: e3d80aaf-3015-5d3e-ad42-3cf986c63cb5
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1155

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/08e63f9e-b4e1-5bee-9296-d38d631c0b4f/anssi-warns-of-multiple-moodle-vulnerabilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup