CVE-2015-2268: filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x befo...

Security readout for executives and security teams

CVE-2015-2268 is a Moodle denial-of-service issue in the URL-to-link filter. An authenticated user could submit specially crafted text that triggers excessive CPU use or a partial outage. The impact is service availability, not stated data theft or code execution. Exposure is most likely on older Moodle deployments where authenticated users can create or submit content processed by the URL-to-link filter. Public-facing learning portals with broad student, contractor, or guest accounts have higher availability risk. Treat this as a timely availability fix for any exposed Moodle service. It is not presented as critical or actively exploited, but older unpatched learning platforms can be disrupted by ordinary authenticated accounts. Mitigation focus: Inventory Moodle versions and identify affected 2.5.x, 2.6.x, 2.7.x, and 2.8.x deployments.; Upgrade 2.6.x to 2.6.9, 2.7.x to 2.7.6, or 2.8.x to 2.8.4 or later.; For 2.5.x systems, check Moodle guidance and plan migration to a supported fixed release..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.