In Moodle installations running affected versions, a local file inclusion vulnerability exists when the hosting environment is misconfigured to allow users access to other users' content. Specifically, an authenticated user with the ability to restore workshop modules and direct access to the web server outside the Moodle webroot can exploit a modified mod_workshop backup to execute local file inclusion. This flaw is limited to shared hosting environments with improper isolation between users. The vulnerability affects versions prior to 4.1.10, versions from 4.2.0 up to but not including 4.2.7, and versions from 4.3.0 up to but not including 4.3.4. A patch is available to remediate this issue.

An attacker who is an authenticated Moodle user with specific permissions and who operates in a misconfigured shared hosting environment can exploit this vulnerability to include local files on the server. This could lead to unauthorized disclosure of sensitive files or other impacts related to local file inclusion. The vulnerability requires both specific user permissions and a hosting environment misconfiguration, limiting its scope.

A patch is available for this vulnerability and should be applied to affected Moodle versions. Administrators should ensure that their hosting environments are properly configured to isolate users and prevent unauthorized access to other users' content. Applying the official Moodle updates that fix this issue will mitigate the risk. No additional vendor advisory content contradicts these recommendations.