In shared hosting setups where access controls are misconfigured to allow cross-user content access, an authenticated Moodle user with the ability to restore database activity modules and direct access to the web server outside the Moodle webroot can exploit a local file inclusion vulnerability via a modified mod_data backup. This flaw affects Moodle versions prior to 4.1.10, versions from 4.2.0 up to but not including 4.2.7, and versions from 4.3.0 up to but not including 4.3.4. The vulnerability is mitigated by applying the available patches.

Successful exploitation could allow an authenticated user to include local files on the server, potentially exposing sensitive information or enabling further attacks. However, exploitation requires a specific misconfiguration in shared hosting environments and certain user permissions, limiting the scope of impact.

A patch is available for this vulnerability. Users should upgrade Moodle to versions 4.1.10 or later, 4.2.7 or later, or 4.3.4 or later as appropriate. Ensuring proper isolation and configuration in shared hosting environments to prevent unauthorized access to other users' content is also recommended.