CVE-2025-26532: Moodle allows teachers to evade trusttext config when restoring glossary entries

February 24, 2025

Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

References

github.com/advisories/GHSA-cw24-f6fq-7j9v
github.com/moodle/moodle
moodle.org/mod/forum/discuss.php?d=466149
nvd.nist.gov/vuln/detail/CVE-2025-26532

Code Behaviors & Features

Detect and mitigate CVE-2025-26532 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →