https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-47192.htmlhttps://patchthecve.com/cve/CVE-2024-47192.htmlWed, 17 Jun 2026 07:56:42 +0000MEDIUM 5.3: An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download.https://patchthecve.com/cve/CVE-2024-35203.htmlhttps://patchthecve.com/cve/CVE-2024-35203.htmlWed, 17 Jun 2026 07:34:32 +0000MEDIUM 6.1: Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system.https://patchthecve.com/cve/CVE-2024-39335.htmlhttps://patchthecve.com/cve/CVE-2024-39335.htmlWed, 17 Jun 2026 07:41:44 +0000CRITICAL 9.1: Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under certain conditions via the 'Current submissions' page: Administration -> Groups -> Submissions.https://patchthecve.com/cve/CVE-2025-29992.htmlhttps://patchthecve.com/cve/CVE-2025-29992.htmlWed, 17 Jun 2026 09:06:02 +0000HIGH 7.5: Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.https://patchthecve.com/cve/CVE-2024-47853.htmlhttps://patchthecve.com/cve/CVE-2024-47853.htmlWed, 17 Jun 2026 07:57:51 +0000HIGH 8.8: An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI).https://patchthecve.com/cve/CVE-2024-45753.htmlhttps://patchthecve.com/cve/CVE-2024-45753.htmlWed, 17 Jun 2026 07:54:45 +0000MEDIUM 6.1: In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute.https://patchthecve.com/cve/CVE-2024-39923.htmlhttps://patchthecve.com/cve/CVE-2024-39923.htmlWed, 17 Jun 2026 07:43:02 +0000MEDIUM 6.1: An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cross Site Scripting (XSS) due to not sanitising the values. These links can only be set up by an admin but are clickable by any logged-in pershttps://patchthecve.com/cve/CVE-2023-47799.htmlhttps://patchthecve.com/cve/CVE-2023-47799.htmlWed, 17 Jun 2026 06:33:18 +0000HIGH 7.5: Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account holders because the cachhttps://patchthecve.com/cve/CVE-2022-45133.htmlhttps://patchthecve.com/cve/CVE-2022-45133.htmlWed, 17 Jun 2026 05:09:25 +0000MEDIUM 6.5: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skins. A particularly structured XML file could allow one to traverse the server to obtain access to secure files or cause code execution based on the payload.https://patchthecve.com/cve/CVE-2022-45134.htmlhttps://patchthecve.com/cve/CVE-2022-45134.htmlWed, 17 Jun 2026 05:09:25 +0000CRITICAL 9.8: Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during skin import. A particularly structured XML file could cause code execution when being processed.