{"id":"CVE-2015-5265","aliases":["EUVD-2022-2300","GHSA-44xp-wj24-9xxj","MGASA-2015-0381","UBUNTU-CVE-2015-5265"],"status":"published","title":"Moodle allows attackers to delete files","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01504,"percentile":0.74488,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-09-23T19:42:52Z","modified":"2026-06-17T00:28:47Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.7.10","2.8.8","2.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.10"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.10"}]}],"versions":["v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.8"}]}],"versions":["v2.8.0","v2.8.1","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.8.6","v2.8.7"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}],"versions":["v2.9.0","v2.9.1"]},{"source":"osv","ecosystem":"Mageia:5","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8-1.mga5"}]}],"bundled":6}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-48371","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320289","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securitytracker.com/id/1033619","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5265","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/037e05e8b266bff4835f0d2eea33ef86fb71d585","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/1d70050f33edb79b974de2509f18c943969589ea","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/40a154551fcdf0b9ea906f4d1313df29754f1fa1","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/78de2e86e8506222cf49b1cc6dc58467750ae83d","tags":["web"]},{"url":"https://web.archive.org/web/20160323063809/http://www.securitytracker.com/id/1033619","tags":["web"]},{"url":"https://github.com/advisories/GHSA-44xp-wj24-9xxj"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0381.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16767","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320287","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320290","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320291","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320292","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=320293","tags":["web"]},{"url":"https://docs.moodle.org/dev/Moodle_2.8.8_release_notes","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=319884","tags":["web"]},{"url":"https://bitbucket.org/oasychev/moodle-plugins/","tags":["web"]},{"url":"https://moodle.org/plugins/view/qtype_oumultiresponse","tags":["web"]},{"url":"https://moodle.org/plugins/view/theme_uikit","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5265","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5265","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"published","published":"2016-02-22T02:00:00Z","modified":"2024-08-06T06:41:09.303Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2022-2300","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"published","published":"2016-02-22T02:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.305488Z"}],"ghsa":[{"id":"GHSA-44xp-wj24-9xxj","title":"Moodle allows attackers to delete files","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"published","published":"2022-05-13T01:12:47Z","modified":"2024-01-26T01:54:42Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2015-5265","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"published","published":"2016-02-22T05:59:05.317Z","modified":"2026-06-17T00:28:47.14Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"GHSA-44xp-wj24-9xxj","title":"Moodle allows attackers to delete files","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"published","published":"2022-05-13T01:12:47Z","modified":"2024-12-08T05:29:59.1133Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"UBUNTU-CVE-2015-5265","description":"The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.","status":"withdrawn","published":"2016-02-22T05:59:00Z","modified":"2025-07-16T07:33:08.88278Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"MGASA-2015-0381","title":"Updated moodle packages fix security vulnerabilities","description":"Updated moodle package fixes security vulnerabilities:\n\nIn Moodle before 2.8.8, completed and graded lesson activity was not\nprotected against making new attempts to answer some questions, so students\ncould re-attempt answering questions in the lesson (CVE-2015-5264).\n\nIn Moodle before 2.8.8, users could delete files uploaded by other users in\nwiki (CVE-2015-5265).\n\nIn Moodle before 2.8.8, meta course synchronisation enrols suspended students\nas managers for a short period of time and causes large database growth. On\nlarge installations, when the sync script takes a long time, suspended\nstudents may get assigned a manager role in meta course for several minutes\n(CVE-2015-5266)\n\nIn Moodle before 2.8.8, password recovery tokens can be guessed because of\nphp randomisation limitations (CVE-2015-5267).\n\nIn Moodle before 2.8.8, when viewing ratings, the group access was not\nproperly checked, allowing users from other groups to view ratings\n(CVE-2015-5268).\n\nIn Moodle before 2.8.8, capability to manage groups does not have XSS risk,\nhowever it was possible to add XSS to the grouping description\n(CVE-2015-5269).\n\nThe moodle package has been updated to version 2.8.8, fixing these issues and\nseveral other bugs.\n\nAdditionally, the preg plugin has been updated to version 2.8, and the OU\nMultiple Response question type and UIkit theme have been added to the\npackage.\n","status":"published","published":"2015-09-23T19:42:52Z","modified":"2026-04-16T06:24:10.605826127Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}