Skip to main content

Moodle 4.5.8

Security Support Only Moodle Version
This version of Moodle receives security fixes, but is no longer supported for general bug fixes.
You may view the releases page to see the support status of all Moodle versions.

Release date: 8 December 2025

Here is the full list of fixed issues in 4.5.8.

General fixes and improvements​

  • MDL-81604 - Broken file serving under PHP 8.1+, Apache and PHP-FPM via mod_proxy_fcgi, when the filename is not only plain ASCII or w/ blank spaces
  • MDL-84898 - Prohibit checks may be slow on large sites
  • MDL-85235 - admin/tool/mobile/mobile.webmanifest.php sets cookies and has poor caching headers
  • MDL-85975 - Excluded fields not removed if they are null during plugin restore
  • MDL-82511 - cache_cron_task causes a failover on redis/sentinel clusters
  • MDL-87194 - AirNotifier access key requests always fail for new sites
  • MDL-87017 - Question bank context exception when home page block on all pages
  • MDL-86822 - Error when enabling editing mode on H5P activity with course block set to "display on all pages"

Accessibility fixes and improvements​

  • MDL-85534 - Skipped heading level on Forum discussion page
  • MDL-87332 - Notification preferences do not show toggles on 4.5
  • MDL-83485 - Use lists instead of div tags in the preferences groups template
  • MDL-85858 - SCORM Player missing page title and iframe title attributes
  • MDL-87245 - SCORM packages that open in a new window should inform users that they open in a new window
  • MDL-87149 - Insufficient contrast for feedback questions with Dependence item set
  • MDL-86998 - Empty <th> table header and empty form label on "Notification preferences" screen presenting accessibility issues
  • MDL-86986 - The core/drag_handle button relies on the title attribute for its accessible label
  • MDL-86855 - Accessibility issues on the qbank_columnsortorder admin settings page
  • MDL-86840 - Accessibility issues on the forum advanced search form
  • MDL-86701 - Use native button elements for the buttons on the custom fields pages
  • MDL-86547 - Consider accessibility improvements for <code> display
  • MDL-86450 - Checkboxes in forum advanced search form not labelled correctly
  • MDL-85820 - Required form field validation issue: client-side adds unnecessary "-"
  • MDL-85796 - Remove the unnecessary title attribute on user profile links (RGAA 6.1 criteria)
  • MDL-85774 - Home page offline RGAA compliance issue
  • MDL-82232 - Incorrect landmark accessible names for the breadcrumb

Performance fixes and improvements​

  • MDL-81304 - Long load times on "my courses"
  • MDL-87019 - Redis session handler memory grows unbounded due to no garbage collection of userkeyprefix hash for user=0
  • MDL-87026 - Course subsections has bad performance compared to normal sections (backport of MDL-86879)
  • MDL-85764 - Quiz queue_quiz_open_notification_tasks_for_users can be very slow

Security improvements​

  • MDL-86369 - Deleting a single attempt from SCORM reports page deletes all user attempts when reloading the page

Security fixes​

  • MSA-25-0051 - Remote code execution risk via file restore
  • MSA-25-0052 - Authentication via LTI Provider available to suspended users
  • MSA-25-0053 - XSS risk via AI prompt injection
  • MSA-25-0054 - XSS risk in formula editor
  • MSA-25-0055 - Formula injection risk when exporting data to CSV / Excel
  • MSA-25-0056 - Open redirect in OAuth login
  • MSA-25-0057 - Password brute force risk from confirmation email web service
  • MSA-25-0058 - Participants can access forum ratings without permission
  • MSA-25-0059 - Reflected XSS risk in policy tool
  • MSA-25-0060 - Badges with a role criterion could be awarded to users who do not hold the role
  • MSA-25-0061 - User IDs exposed in URLs when using anonymous submissions in assignment