PatchTheCVEmahara vulnerabilities
Recent CVEs affecting mahara products. 10 tracked.
mahara has 10 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 10. Most recent: 2025-08-26. Highest priority: CVE-2022-45134 (score 52/100).
- CVE-2025-29992 HIGH 7.5 UPGRADE Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due t
- CVE-2024-47853 HIGH 8.8 UPGRADE An issue was discovered in Mahara 23.04.8 and 24.04.4
- CVE-2024-47192 MEDIUM 5.3 UPGRADE An issue was discovered in Mahara 23.04.8 and 24.04.4
- CVE-2024-45753 MEDIUM 6.1 UPGRADE In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malici
- CVE-2024-39923 MEDIUM 6.1 UPGRADE An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7
- CVE-2024-39335 CRITICAL 9.1 UPGRADE Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being
- CVE-2024-35203 MEDIUM 6.1 UPGRADE Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code
- CVE-2023-47799 HIGH 7.5 UPGRADE Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk expo
- CVE-2022-45134 CRITICAL 9.8 UPGRADE Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely d
- CVE-2022-45133 MEDIUM 6.5 UPGRADE Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 allows unsafe font upload for skin
FAQ
How do I fix mahara vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mahara being exploited right now?
None of the tracked mahara CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mahara CVE should I patch first?
CVE-2022-45134 currently ranks highest (52/100): Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely d.