Moodle patches XSS, SSRF, CSRF flaws

Published23 June 2026 Vorant ratingroutine vulnerability Education

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Multiple vulnerabilities in Moodle versions 4.5.x through 5.2.x allow remote attackers to perform XSS, SSRF, CSRF, and denial-of-service attacks.

Sourcecert.ssi.gouv.fr — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

The French cybersecurity agency CERT-FR has published an advisory detailing multiple security vulnerabilities affecting Moodle learning management system across versions 4.5.x through 5.2.x. The flaws enable various attack vectors including cross-site scripting (XSS), server-side request forgery (SSRF), cross-site request forgery (CSRF), denial of service, and security policy bypass.

Affected versions include Moodle 4.5.x prior to 4.5.12, 5.0.x prior to 5.0.8, 5.1.x prior to 5.1.5, and 5.2.x prior to 5.2.1. Organizations running Moodle should apply the patches released by the vendor to remediate these issues.

Moodle published ten separate security bulletins on June 22, 2026, addressing the vulnerabilities. The advisory recommends consulting the vendor's security bulletins for obtaining the appropriate patches for affected installations.

Detection guidance

Web Application Process Spawning Command Interpreter (Possible Moodle Exploitation)

ATT&CK T1059 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web server or PHP-FPM process spawning a shell/command interpreter, a common post-exploitation indicator following exploitation of a web application vulnerability such as those patched in Moodle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Application Process Spawning Command Interpreter
id: a03af742-4124-5dfc-83fa-0eddee57b533
status: experimental
description: Detects a web server / PHP-FPM process spawning a command shell or scripting
  interpreter, which can indicate successful exploitation of a web application vulnerability
  (e.g. as described in Moodle security advisories) leading to remote command execution.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \php-cgi.exe
    - \php-fpm.exe
    - \w3wp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \sh.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate web application administrative scripts that shell out to system utilities
- Scheduled maintenance or backup scripts executed via web-triggered cron/cgi handlers
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant

Web Server Outbound Connection to Cloud Metadata Endpoint (Possible SSRF)

ATT&CK T1190 · status experimental · needs windows network_connection logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a web application server process (e.g. Apache, nginx, PHP-FPM, IIS) initiating a connection to the cloud instance metadata service IP, a common target of SSRF exploitation such as the SSRF flaw patched in Moodle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Connecting to Cloud Metadata Service
id: 141bd3d0-7f96-5348-a15d-4d7c12a03317
status: experimental
description: Detects a web application server or PHP process making an outbound connection
  to the well-known cloud metadata IP address (169.254.169.254), which is a common
  exploitation target for server-side request forgery (SSRF) vulnerabilities such
  as those recently patched in Moodle.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \php-cgi.exe
    - \php-fpm.exe
    - \w3wp.exe
    DestinationIp: 169.254.169.254
  condition: selection
falsepositives:
- Legitimate cloud-native applications intentionally querying instance metadata for
  configuration purposes
level: medium
tags:
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0794

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs