CVE-2026-7275

Overview

Moodle is an open source learning management system written in PHP. Schools, universities, and companies use it to run online courses. IOMAD is a multi-tenant distribution of Moodle that lets one installation serve several companies or organizations; it is built on Moodle core and shares the affected code. The Google Drive repository plugin (repository_googledocs) lets users pick files from their Google Drive in the Moodle file picker. When the site connects a Google system account, users can also add a file as an access controlled link, and Moodle then copies the file into the system account's Drive.

A Remote Code Execution (RCE) vulnerability (CVE-2026-7275) has been identified in the file handling shared by Moodle's repository plugins, which allows a user of the Google Drive repository plugin to write a file of their choosing to a location outside Moodle's temporary directory by giving a file in their Drive a crafted name, and so run code on the server. Moodle tracks this issue as MSA-26-0006 (MDL-88423).

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

This issue affects all versions of Moodle before 4.5.11, versions 5.0.0 through 5.0.6, and versions 5.1.0 through 5.1.3, including End-of-Life release lines such as Moodle 4.3. IOMAD releases built on these Moodle versions contain the same code and are affected as well.

Details

Module Info

• Product: Moodle, IOMAD
• Affected packages: moodle/moodle (repository/lib.php, repository/googledocs)
• Affected versions: <4.5.11, >=5.0.0 <5.0.7, >=5.1.0 <5.1.4
• GitHub repository: https://github.com/moodle/moodle (Moodle), https://github.com/iomad/iomad (IOMAD)
• Published packages: https://packagist.org/packages/moodle/moodle
• Package manager: Composer
• Fixed in:
  • OSS Moodle 4.5.11, 5.0.7, 5.1.4
  • NES for Moodle v4.3.13
  • NES for IOMAD v4.3.4

Vulnerability Info

This High-severity vulnerability is found in the moodle/moodle package in all versions before 4.5.11, 5.0.0 through 5.0.6, and 5.1.0 through 5.1.3 of Moodle, and in IOMAD releases built on those versions. Moodle rates it Serious.

Repository plugins download remote files to a temporary location before Moodle stores them. They get that location from repository::prepare_file() in repository/lib.php, which joined a new per-request directory and the file name it was given without checking the name:

public function prepare_file($filename) {
    if (empty($filename)) {
        $filename = 'file';
    }
    return sprintf('%s/%s', make_request_directory(), $filename);
}

A name that contains ../ sequences therefore produces a path outside the request directory. Most callers pass a name that Moodle has already cleaned, but the Google Drive plugin passes the name of the file as it is stored in Google Drive. When a user adds a Drive file as an access controlled link, reference_file_selected() downloads the file with the user's own Google account so it can upload a copy to the system account:

$originalfile = $this->get_file_summary($userservice, $source->id);
// Use the user service to download the file.
$downloadedfile = $this->download_file(
    $userservice,
    $source->id,
    $originalfile->name,
);

download_file() passes that name to prepare_file() and writes the downloaded content to the resulting path. The user controls both the name and the content of a file in their own Drive, so a file named with enough ../ segments can be written anywhere the web server user can write. Writing a PHP file into a location the web server executes, or overwriting one, can lead to code execution on the server.

Exploitation needs a site with the Google Drive repository enabled and a connected system account that allows access controlled links, and a user who can use the repository in the file picker. The repository/googledocs:view capability is granted to the authenticated user role by default, so this can include students wherever they are allowed to add files. Sites that do not use the Google Drive repository are not exposed through this route. The Google Drive download step was added in Moodle 4.5.7 and 5.0.3; older releases, including Moodle 4.3, copy the file through the Google Drive API instead, but contain the same unchecked prepare_file().

The fix makes prepare_file() keep only a plain file name by cleaning it with PARAM_FILE, which strips path separators, so every repository plugin that uses it now writes inside its request directory:

return sprintf('%s/%s', make_request_directory(), clean_param($filename, PARAM_FILE));

Mitigation

Moodle publishes security fixes only for its supported release lines. Earlier release lines, including Moodle 4.3 and the IOMAD releases built on it, are End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, sites can disable the Google Drive repository plugin, as Moodle's advisory recommends.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Moodle 4.5.11, 5.0.7, 5.1.4, or later, or to an IOMAD release built on one of those versions.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Ophion Security in collaboration with Claude and Anthropic Research (finder)