CVE-2025-54869

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Moodle bundles FPDI, a PHP library from Setasign that reads pages from existing PDF files so they can be reused as templates. The assignment module's Annotate PDF feedback plugin uses it to import the PDFs that students submit.

A Denial of Service (DoS) vulnerability (CVE-2025-54869) has been identified in the copy of FPDI bundled with Moodle and IOMAD, which allows a user who can upload a PDF that Moodle processes to submit a small, crafted file that makes the PHP process exhaust its memory and crash. Moodle tracks this issue as MSA-25-0042 (MDL-86353).

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects all versions of Moodle before 4.1.21, versions 4.2.0 through 4.4.10, versions 4.5.0 through 4.5.6, and versions 5.0.0 through 5.0.2, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (bundled setasign/fpdi in lib/fpdi)
• Affected versions: <4.1.21, >=4.2.0 <4.4.11, >=4.5.0 <4.5.7, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3 (FPDI 2.6.4)
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Medium-severity vulnerability is found in the FPDI library bundled in the moodle/moodle package in all versions before 4.1.21, 4.2.0 through 4.4.10, 4.5.0 through 4.5.6, and 5.0.0 through 5.0.2 of Moodle, and in IOMAD releases built on those versions. The upstream issue affects FPDI versions before 2.6.4 (GHSA-jxhh-4648-vpp3). Moodle rates it Serious.

A PDF file is a graph of objects that point to each other through indirect references, and the page tree is a set of /Pages dictionaries whose /Kids arrays point to child pages. FPDI followed those references without remembering which objects it had already visited. PdfType::resolve() resolved indirect references recursively, and PdfReader::getPage() and PdfReader::readPages() walked the /Kids arrays the same way.

A crafted PDF can make an object refer back to itself, or make a /Pages node list one of its own ancestors as a kid. FPDI then loops or recurses without end until PHP runs out of memory or stack and the request dies. The file can be small, and each request that processes it ties up a PHP worker until it crashes, so repeated uploads can keep the site unavailable.

In Moodle, the most direct route is the assignment module. When a teacher opens a submission for annotation, or Moodle converts submissions in the background, the Annotate PDF plugin loads the student's PDF through FPDI. A student who can submit a PDF to an assignment with annotation enabled can therefore trigger the crash.

FPDI 2.6.4 tracks the objects and page nodes it has already processed and throws an exception when it sees one again. PdfType::resolve() now fails with Indirect reference recursion detected, and the page-tree walk fails with Recursive pages dictionary detected, so a malicious file is rejected instead of exhausting the server. The fix updates the bundled FPDI in lib/fpdi to 2.6.4 and reapplies Moodle's local changes to the library.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.1.21, 4.4.11, 4.5.7, 5.0.3, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• N0zoM1z0 (finder, upstream FPDI advisory)