Threats tagged 'ghsa-7rxw-r686-cf95'

Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain a path traversal vulnerability in the Blackboard question import format. This flaw allows teachers with question import or lesson edit permissions to upload crafted zip files with image source paths containing '../' sequences, enabling them to copy server files such as config.php into their draft area.