Vulnerability record · CVE-2022-35650 · published 25 July 2022
CVE-2022-35650: Moodle lesson question import path traversal allows arbitrary file read
Moodle · Moodle
Moodle fails to properly validate input paths when importing lesson questions, allowing directory traversal. A remote attacker who can reach that import feature can read files outside the intended directory. The flaw is a path traversal rooted in insufficient input validation.
Description
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityHigh CVSS (7.5) and very high EPSS with a patch available, though exploitation requires an account with teacher-level or higher access.
What it is
Moodle fails to properly validate input paths when importing lesson questions, allowing directory traversal. A remote attacker who can reach that import feature can read files outside the intended directory. The flaw is a path traversal rooted in insufficient input validation.
Impact
An attacker gains read access to arbitrary files on the Moodle server, which can expose configuration, credentials and other sensitive data. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reached over the network through the lesson question import functionality; the CVSS vector shows no privileges or user interaction required, but the description states the feature is by default limited to teachers, managers and admins, so practical access depends on holding one of those roles.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented; EPSS is high at roughly 0.49 (98.8th percentile), and references include patch and vendor advisory tags but no public exploit tag.
What to do
- Apply the Moodle fix referenced by MDL-72029 and update to a patched Moodle release.
- Update Fedora packages per the Fedora package-announce advisories.
- Restrict teacher, manager and admin roles to trusted accounts and review who holds them.
- Limit filesystem permissions so the web server user cannot read sensitive files outside the Moodle data and code directories.
Detection
- Review web server and Moodle logs for lesson question import requests containing traversal sequences such as ../ or encoded variants.
- Alert on file read activity by the web server user outside expected Moodle directories.
- Monitor for unusual access to configuration files such as config.php from web processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-35650 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-35650), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
