# Moodle patches XSS, SSRF, CSRF flaws

Published: 2026-06-23 · Severity: medium · Sectors: education
Canonical: https://vorant.io/reports/bf3532f0-b636-5afd-8385-d4db7e6a0eb5/moodle-patches-xss-ssrf-csrf-flaws

> Multiple vulnerabilities in Moodle versions 4.5.x through 5.2.x allow remote attackers to perform XSS, SSRF, CSRF, and denial-of-service attacks.

The French cybersecurity agency CERT-FR has published an advisory detailing multiple security vulnerabilities affecting Moodle learning management system across versions 4.5.x through 5.2.x. The flaws enable various attack vectors including cross-site scripting (XSS), server-side request forgery (SSRF), cross-site request forgery (CSRF), denial of service, and security policy bypass.

Affected versions include Moodle 4.5.x prior to 4.5.12, 5.0.x prior to 5.0.8, 5.1.x prior to 5.1.5, and 5.2.x prior to 5.2.1. Organizations running Moodle should apply the patches released by the vendor to remediate these issues.

Moodle published ten separate security bulletins on June 22, 2026, addressing the vulnerabilities. The advisory recommends consulting the vendor's security bulletins for obtaining the appropriate patches for affected installations.

## Detection guidance (public sample)

### Web Application Process Spawning Command Interpreter (Possible Moodle Exploitation)

ATT&CK: T1059

Detects a web server or PHP-FPM process spawning a shell/command interpreter, a common post-exploitation indicator following exploitation of a web application vulnerability such as those patched in Moodle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Application Process Spawning Command Interpreter
id: a03af742-4124-5dfc-83fa-0eddee57b533
status: experimental
description: Detects a web server / PHP-FPM process spawning a command shell or scripting
  interpreter, which can indicate successful exploitation of a web application vulnerability
  (e.g. as described in Moodle security advisories) leading to remote command execution.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \php-cgi.exe
    - \php-fpm.exe
    - \w3wp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \sh.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate web application administrative scripts that shell out to system utilities
- Scheduled maintenance or backup scripts executed via web-triggered cron/cgi handlers
level: high
tags:
- attack.t1059
- attack.t1190
author: Vorant
```

### Web Server Outbound Connection to Cloud Metadata Endpoint (Possible SSRF)

ATT&CK: T1190

Detects a web application server process (e.g. Apache, nginx, PHP-FPM, IIS) initiating a connection to the cloud instance metadata service IP, a common target of SSRF exploitation such as the SSRF flaw patched in Moodle. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Connecting to Cloud Metadata Service
id: 141bd3d0-7f96-5348-a15d-4d7c12a03317
status: experimental
description: Detects a web application server or PHP process making an outbound connection
  to the well-known cloud metadata IP address (169.254.169.254), which is a common
  exploitation target for server-side request forgery (SSRF) vulnerabilities such
  as those recently patched in Moodle.
references:
- https://www.cert.ssi.gouv.fr/
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \php-cgi.exe
    - \php-fpm.exe
    - \w3wp.exe
    DestinationIp: 169.254.169.254
  condition: selection
falsepositives:
- Legitimate cloud-native applications intentionally querying instance metadata for
  configuration purposes
level: medium
tags:
- attack.t1190
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0794

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bf3532f0-b636-5afd-8385-d4db7e6a0eb5/moodle-patches-xss-ssrf-csrf-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup