CVE-2025-13488
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, hijacking sessions or performing actions on their behalf. This affects organizations using repositories with the vulnerable version.
Recommendation
Update the software to a version where the regression is fixed. Check for unauthorized content in repositories.
Other vulnerabilities in Repositories
See all- CVE-2014-3541High
The Repositories component in Moodle through 2.3.11, and in versions 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.
- CVE-2026-66375High
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
Original NVD description (English source)
Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS