Mahara vulnerabilities
We track 9 vulnerabilities in Mahara products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on August 26, 2025.
Latest Mahara vulnerabilities
- 9.1 Critical severity
Mahara: Exposure of Sensitive Information to an Unauthorized Actor
Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under certain conditions via the 'Current submissions' page: Administration -> Groups -> Submissions.
- 7.5 High severity
Mahara: Exposure of Sensitive Information to an Unauthorized Actor
Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.
- 8.8 High severity
Mahara: Improper Privilege Management
An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI).
- 7.5 High severity
Mahara: Exposure of Sensitive Information to an Unauthorized Actor
Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images o
- 9.8 Critical severity
Mahara: Deserialization of Untrusted Data
Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed.
- 9.8 Critical severity
Mahara: Execution with Unnecessary Privileges
Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.
- 7.5 High severity
Mahara: Improper Access Control
In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.
- 7.5 High severity
Mahara: Incorrect Default Permissions
In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the view
- 8.8 High severity
Mahara: Cross-Site Request Forgery
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.