CVE-2025-26528: Stored XSS in the drag and drop onto image question type in Moodle
The drop zone label in the drag and drop onto image question type accepted any HTML and was output unfiltered. Scripts in it ran in the browser of everyone who saw the question.
1Summary
- Advisory
- MSA-25-0004
- System
- Moodle
- Component
- Drag and drop onto image question type (qtype_ddimageortext)
- Class
- Stored cross-site scripting (XSS)
- Severity
- Minor
In drag and drop onto image questions, participants drag text or images onto zones in a background image. Each zone has a label that is not visible on the page and is only read out by screen readers.
The editing form accepted this label as raw data (PARAM_RAW). The renderer then passed it to the page and to the question's JavaScript without format_string(), so HTML and scripts in the label survived.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0004.
2Who is affected
Users allowed to create or edit questions of this type.
Only someone allowed to create or edit questions of this type can save such a label. The script runs for everyone the question is shown to, in a quiz attempt as well as in preview or review.
3Impact
In the viewer's browser the script runs inside their Moodle session and can act on their behalf. If an account with broad permissions opens the question, for example in preview, those permissions are available to the script.
4Fix
- Affected versions
- 4.5.0 to 4.5.1, 4.4.0 to 4.4.5, 4.3.0 to 4.3.9, 4.1.15 and earlier
- Fixed in
- 4.5.2, 4.4.6, 4.3.10, 4.1.16
- Published
- 18 Feb 2025
- Fix in the source
- 1ea3084
Since the fix, the form only accepts plain text (PARAM_TEXT), and the renderer passes the label through format_string() before output. Because the protection sits at output, it also covers questions saved before the upgrade.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.