The Moodle Jmol plugin version 6.1 and prior contains a path traversal vulnerability (CWE-22) in the jsmol.php script. The script accepts a query parameter that is passed directly to the PHP file_get_contents() function without sanitization or validation. This flaw enables remote attackers to craft malicious requests that read arbitrary files from the server filesystem. The vulnerability requires no authentication and has a CVSS 4.0 score of 8.7 (high severity), reflecting its network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact. Exploitation evidence was documented by Shadowserver Foundation on 2025-02-02 UTC. No patch or official fix has been disclosed as of the publication date.

Successful exploitation allows unauthenticated attackers to read arbitrary files on the affected server, potentially exposing sensitive configuration files including database credentials. This can lead to further compromise of the Moodle LMS environment or connected systems. The high CVSS score indicates a significant confidentiality impact with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the vulnerable jsmol.php script or applying web application firewall (WAF) rules to block malicious path traversal attempts. Monitoring for exploitation attempts is advised given the observed exploitation evidence.