-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.1.0, < 4.1.2 | 4.1.2 |
| moodle/moodle | composer | >= 4.0.0, < 4.0.7 | 4.0.7 |
| moodle/moodle | composer | >= 3.11.0, < 3.11.13 | 3.11.13 |
| moodle/moodle | composer | < 3.9.20 | 3.9.20 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unvalidated use of $data['initialcontent'] in file_get_contents. The patch adds clean_param() with PARAM_FILE filter to sanitize the filename input. The affected function is clearly identified in the commit diff modifying mod/wiki/backup/moodle1/lib.php, and the CWE-20 classification matches the missing input validation pattern. The function's role in backup processing aligns with the vulnerability's context of malicious backup file exploitation.
Ongoing coverage of React2Shell