CVE-2025-3641: Remote code execution in the Moodle Dropbox repository
Moodle stored references to Dropbox files as serialized PHP values and read them back on every access without restricting classes. Anyone allowed to add files to a course could use this to run code on the server.
1Summary
- Advisory
- MSA-25-0023
- System
- Moodle
- Component
- Dropbox repository (repository_dropbox)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
A file from Dropbox does not have to be copied into Moodle. Moodle can store just a reference while the file stays with the provider.
The Dropbox repository read that reference with unserialize() without specifying the permitted classes. Once a modified reference is in the database, reading it creates objects from the Moodle code base through which code can eventually be executed on the server.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0023.
2Who is affected
Editing teachers and managers, on sites with the Dropbox repository enabled.
By default, editing teachers and managers may add files from repositories; students and guests may not.
The Dropbox repository has to be enabled. Universities often have hundreds of external lecturers with teacher accounts, and a single compromised one is enough as a starting point.
3Impact
With code on the server, the database password in config.php is readable, and with it the grades, submissions and personal data of every account. Separating courses does not help here, because the attack works below Moodle's permission checks.
4Fix
- Affected versions
- 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, 4.3.0 to 4.3.11, 4.1.17 and earlier
- Fixed in
- 4.5.4, 4.4.8, 4.3.12, 4.1.18
- Published
- 22 Apr 2025
- Fix in the source
- 27b839b
Moodle now reads the references with unserialize_object(), which only creates plain data objects.
If you cannot upgrade right away, switch off the Dropbox repository until you can.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.