Mahara vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-39335 Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under cCritical 9.1 · Aug 26, 2025
• CVE-2025-29992 Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or toHigh 7.5 · Aug 26, 2025
• CVE-2024-47853 An issue was discovered in Mahara 23.04.8 and 24.04.4.High 8.8 · Aug 26, 2025
• CVE-2023-47799 Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or viaHigh 7.5 · Aug 25, 2025
• CVE-2022-45134 Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import.Critical 9.8 · Aug 22, 2025
• CVE-2022-44544 Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if thCritical 9.8 · Nov 6, 2022
• CVE-2022-42707 In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permisHigh 7.5 · Nov 6, 2022
• CVE-2022-33913 In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.High 7.5 · Jun 20, 2022
• CVE-2022-29585 In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used.High 7.5 · Apr 28, 2022
• CVE-2022-28892 Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessabHigh 8.8 · Apr 28, 2022
• CVE-2021-40849 In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resuCritical 9.8 · Nov 3, 2021
• CVE-2021-40848 In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leHigh 7.8 · Nov 3, 2021
• CVE-2021-43266 In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collectHigh 7.3 · Nov 2, 2021
• CVE-2018-11196 Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A High 7.5 · Jun 1, 2018
• CVE-2017-1000171 Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.Critical 9.8 · Nov 3, 2017
• CVE-2017-1000154 Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in Critical 9.8 · Nov 3, 2017
• CVE-2017-1000153 Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent Critical 9.8 · Nov 3, 2017
• CVE-2017-1000152 Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the saCritical 9.8 · Nov 3, 2017
• CVE-2017-1000151 Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusualHigh 7.5 · Nov 3, 2017
• CVE-2017-1000150 Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout.High 8.8 · Nov 3, 2017
• CVE-2017-1000148 Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML throHigh 8.8 · Nov 3, 2017
• CVE-2017-1000139 Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all prHigh 8 · Nov 3, 2017
• CVE-2017-1000134 Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group fHigh 8.1 · Nov 3, 2017
• CVE-2017-1000133 Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts High 7.5 · Nov 3, 2017
• CVE-2017-14163 An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3.High 8.8 · Oct 31, 2017