CVE-2026-58331

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Database activity (mod_data) lets a course build a shared collection of entries with fields such as text, files, and pictures. Its Import entries page accepts a CSV file, or a ZIP archive that holds a CSV file plus a files/ directory with the files and pictures that the CSV rows refer to by name.

A Path Traversal vulnerability (CVE-2026-58331) has been identified in the Database activity import feature of Moodle and IOMAD, which allows a user who can import entries to read arbitrary files from the server by naming them, with ../ sequences, in the file or picture columns of the imported CSV. Moodle tracks this issue as MSA-26-0012 (MDL-88595).

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

This issue affects all versions of Moodle before 4.5.12, versions 5.0.0 through 5.0.7, versions 5.1.0 through 5.1.4, and version 5.2.0, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (mod/data/classes/local/importer)
• Affected versions: <4.5.12, >=5.0.0 <5.0.8, >=5.1.0 <5.1.5, >=5.2.0 <5.2.1
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.12, 5.0.0 through 5.0.7, 5.1.0 through 5.1.4, and 5.2.0 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

When a ZIP archive is imported, csv_entries_importer::import_csv() reads each CSV row and, for every field that supports file import (the file and picture field types), treats the cell value as the name of a file in the archive. It loads that file and stores its contents as the entry's attachment, using the cell value as the file name:

if ($field->file_import_supported() && $this->importfiletype === 'zip') {
    $filecontent = $this->get_file_content_from_zip($content->content);
    if (!$filecontent) {
        // No corresponding file in zip archive, so no record for this field being added at all.
        continue;
    }
    $contentid = $DB->insert_record('data_content', $content);
    $field->import_file_value($contentid, $filecontent, $content->content);

entries_importer::get_file_content_from_zip() built the path by appending the name from the CSV to the temporary directory the archive was extracted into, and read whatever file was at that path:

// Just to be sure extract if not extracted yet.
$this->extract_zip();
if (!str_ends_with($zipsubdir, '/')) {
    $zipsubdir .= '/';
}
$filepathinextractedzip = $this->extracteddir . $zipsubdir . $filename;
return file_exists($filepathinextractedzip) ? file_get_contents($filepathinextractedzip) : false;

Nothing checked that the name stayed inside the extracted files/ directory. A CSV cell made of ../ segments followed by the path of a file on the server, such as Moodle's config.php, makes the importer read that file instead of one from the archive and save its contents into Moodle's file storage as an attachment of the new entry, where the importing user can then download it.

The import page, mod/data/import.php, requires mod/data:manageentries, which is granted by default to the Teacher, Non-editing teacher, and Manager roles. A user with that capability in a Database activity that has a file or picture field can read any file the web server user can read, including config.php with the database password, which can lead to a full compromise of the site. Students and other users without mod/data:manageentries are not exposed, and plain CSV imports that are not in a ZIP archive do not read files at all.

The fix cleans the name with PARAM_FILE before building the path. PARAM_FILE removes slashes, backslashes, colons, and control characters, and turns . and .. into an empty string, so the name can only refer to a file directly inside the archive's files/ directory:

if (!str_ends_with($zipsubdir, '/')) {
    $zipsubdir .= '/';
}
$filename = clean_param($filename, PARAM_FILE);
$filepathinextractedzip = $this->extracteddir . $zipsubdir . $filename;

A second change in import_csv() checks each row's file and picture fields against the archive before creating the entry, and skips the row when all of its fields are file fields and none of them has a matching file, so a rejected row no longer leaves an empty entry behind.

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, restrict the mod/data:manageentries capability to trusted roles, for example by removing it from the Non-editing teacher role, so that only trusted users can import entries into Database activities.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.12, 5.0.8, 5.1.5, 5.2.1, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• POVGen (finder)