CVE-2025-34031
A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 2.91% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- geoffrowland/jmol
- Source
- disclosure@vulncheck.com
References
- https://vulncheck.com/advisories/moodle-lms-jmol-plugin-path-traversalThird Party Advisory
- https://www.dionach.com/moodle-jmol-plugin-multiple-vulnerabilities/Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/46881Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/46881Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.