CVE-2026-58347

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. Every user has a profile with a free-text Description field, edited through the profile editing forms and shown on the user's profile page.

A Denial of Service (DoS) vulnerability (CVE-2026-58347) has been identified in the user profile editing forms of Moodle and IOMAD, which allows an authenticated user to save a profile description of unlimited length. The oversized content can then consume server resources wherever the description is processed and displayed. Moodle tracks this issue as MSA-26-0028 (MDL-87898).

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (user/editlib.php, user/edit_form.php, user/editadvanced_form.php)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

Both profile forms, user_edit_form (users editing their own profile) and user_editadvanced_form (administrators editing any account), build their shared fields in useredit_shared_definition() in user/editlib.php. Most text fields there carry a maxlength attribute, but the description is a rich text editor accepted as raw HTML with no size limit:

$mform->addElement('editor', 'description_editor', get_string('userdescription'), null, $editoroptions);
$mform->setType('description_editor', PARAM_RAW);
$mform->addHelpButton('description_editor', 'userdescription');

Neither form's validation() method checked the length of description_editor either, so the server accepted and stored a description of any size the request could carry. The stored value is then loaded, run through Moodle's text filters, and rendered each time the description is shown, such as on the profile page. Moodle's advisory describes the missing maximum length as a denial of service risk: very large descriptions can tie up server memory and processing time on every request that handles them.

By default, every authenticated user holds moodle/user:editownprofile, so any logged-in user who can edit their own profile can save an oversized description. Guest users cannot, because the capability is prohibited for the guest role.

The fix adds useredit_validate_description_length() to user/editlib.php and calls it from the validation() method of both forms. Descriptions longer than 50,000 characters are rejected with a form error. Sites can change the limit by defining USER_DESCRIPTION_MAX_LENGTH in config.php:

function useredit_validate_description_length(array $data): array {
    if (defined('USER_DESCRIPTION_MAX_LENGTH')) {
        $maxlength = USER_DESCRIPTION_MAX_LENGTH;
    } else {
        // Default maximum character length for a user profile description.
        $maxlength = 50000;
    }
    $errors = [];
    if (!empty($data['description_editor']['text'])) {
        if (core_text::strlen($data['description_editor']['text']) > $maxlength) {
            $errors['description_editor'] = get_string('maximumchars', '', $maxlength);
        }
    }
    return $errors;

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• David Bogner (finder)