CVE-2013-1833: Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10,...

Security readout for executives and security teams

This is an authenticated stored XSS issue in Moodle’s File Picker. A logged-in user could use a specially crafted filename to inject script or HTML. The main business risk is compromise of users who view the malicious filename, especially administrators or teachers in legacy Moodle environments. Exposure is likely limited to old Moodle deployments in the listed version ranges with File Picker functionality available to authenticated users. Internet-facing learning portals increase impact, but the source bundle does not identify affected downstream products beyond Moodle/Fedora packaging. Prioritize remediation for any internet-facing or broadly accessible legacy Moodle instance. This is not confirmed as actively exploited in the provided sources, but authenticated XSS can become serious if administrators handle attacker-controlled content. Mitigation focus: Upgrade Moodle to 2.2.8, 2.3.5, 2.4.2, or later applicable supported releases.; Review Moodle advisory and MDL-37507 guidance for the exact vendor fix context.; Limit File Picker access to trusted authenticated users until patched..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.