CVE-2026-58339

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Feedback activity (mod_feedback) lets teachers build surveys, and its Import questions page loads a set of questions from an XML file, such as one exported from another Feedback activity.

A Cross-Site Scripting (XSS) vulnerability (CVE-2026-58339) has been identified in the question import page of the Feedback activity in Moodle and IOMAD, which allows an attacker who gets a teacher to import a crafted XML file to run JavaScript in that teacher's browser through the import error message. Moodle tracks this issue as MSA-26-0020 (MDL-88543).

Per OWASP: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/feedback)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This Low-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Minor.

mod/feedback/import.php parses the uploaded XML file and creates one Feedback item for each ITEM element. Each element names its question type in a TYPE attribute, and feedback_import_loaded_data() read that attribute without cleaning it. When no item class existed for the type, the raw value went into an error message:

//check the typ
$typ = $item['@']['TYPE'];
...
$itemclass = 'feedback_item_'.$typ;
if ($typ != 'pagebreak' AND !class_exists($itemclass)) {
    $error->stat = false;
    $error->msg[] = 'type ('.$typ.') not found';
    continue;
}

After the import, the page prints every collected message as HTML without escaping it:

if (isset($importerror->msg) AND is_array($importerror->msg)) {
    echo $OUTPUT->box_start('generalbox errorboxcontent boxaligncenter');
    foreach ($importerror->msg as $msg) {
        echo $msg.'<br />';
    }
    echo $OUTPUT->box_end();
}

A TYPE attribute that contains HTML or a script therefore comes back in the response to the import request and runs in the browser of the person who uploaded the file. The page is only reachable with the mod/feedback:edititems capability, which the editing teacher and manager roles have by default, so the attacker cannot trigger it alone: they need a teacher or manager to import a file they supplied, for example a question set shared as a template. The script then runs with that user's session and can act on their behalf in Moodle. Users who never import Feedback questions from untrusted files are not exposed.

The fix cleans the type with PARAM_ALPHA as soon as it is read, so only letters can reach the error message:

//check the typ
$typ = clean_param($item['@']['TYPE'], PARAM_ALPHA);

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Paul Holden from Moodle HQ (finder)