CVE-2025-3642: Remote code execution in the Moodle EQUELLA repository
The EQUELLA repository read its file references with unserialize() and allowed every class while doing so. Teachers could run code on the server through manipulated references.
1Summary
- Advisory
- MSA-25-0024
- System
- Moodle
- Component
- EQUELLA repository (repository_equella)
- Class
- Remote code execution (unsafe deserialization)
- Severity
- Serious
EQUELLA is a platform for learning material that Moodle can connect as a repository. Linked material stays there, and Moodle keeps only a stored reference.
The repository read that reference in several places, for example when fetching or synchronising a file. None of them restricted the allowed classes.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0024.
2Who is affected
Teachers and managers on sites that have EQUELLA connected as a repository.
By default this affects teacher and manager accounts that add repository files to courses.
Without an enabled EQUELLA repository the flaw did not exist. It belongs to the same series as CVE-2025-3641 in the Dropbox repository and was fixed in the same release.
3Impact
Anyone able to run their own code on the Moodle server can read the database credentials and get to data from every course. A teaching assignment in one course was enough to start.
4Fix
- Affected versions
- 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, 4.3.0 to 4.3.11, 4.1.17 and earlier
- Fixed in
- 4.5.4, 4.4.8, 4.3.12, 4.1.18
- Published
- 22 Apr 2025
- Fix in the source
- 630fbf6
References now go through a shared method that uses unserialize_object() and only produces plain data objects.
Until the upgrade, disabling the EQUELLA repository avoids the risk.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.