Description
A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | moodle | 5.2.0 – < 5.2.2, 5.1.0 – < 5.1.6, 5.0.0 – < 5.0.9, < 4.5.13 | 5.2.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Advisories 1
- WID-SEC-2026-3686 Moodle: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 30, 2026