Skip to main content

Improper Neutralization of Formula Elements in a CSV File

CVE-2025-67851

High
7.8/10

Summary

A flaw was found in Moodle versions prior to 4.1.22, 4.2.0-beta prior to 4.4.12, 4.5.0-beta prior to 4.5.8, 5.0.0-beta prior to 5.0.4 and 5.1.0-beta prior to 5.1.1. This Formula Injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.

  • LOW
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

The software saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software.

References

Advisory Timeline

  • Published