A recent vulnerability in Moodle’s Jmol plugin allows attackers to traverse the filesystem and read any file on the server. The flaw resides in the jsmol.php script, which accepts a query parameter and passes it directly to file_get_contents() without sanitization. An attacker can supply a crafted value that causes the server to read arbitrary files, including configuration files that store database credentials. The issue can be triggered without authentication, and Shadowserver confirmed exploitation in February 2025.

Any Moodle installation that has Jmol plugin version 6.1 or older is affected. This includes all deployments that have not upgraded the plugin beyond the stated version. The problem is limited to the Jmol plugin module and does not involve other Moodle components.

The vulnerability has a CVSS score of 8.7, indicating high severity, and an EPSS of 18%, suggesting a substantive likelihood of exploitation in the near term. It is not listed in CISA’s KEV catalog, but the recent proof‑of‑concept activity and the high EPSS indicate that it may be actively targeted. Attackers can exploit this flaw remotely via HTTP requests, bypassing authentication, and read sensitive files directly from the file system.