A path traversal flaw exists in the Blackboard question import format of Moodle. When a teacher uploads a specially crafted ZIP file that contains image source references with "../" sequences, the system copies server files—such as config.php—into the teacher's draft area. The flaw does not directly enable code execution but allows an authenticated teacher to read arbitrary files from the web root, exposing configuration data, credentials, or other sensitive information.

The vulnerability affects Moodle instances from version 4.5.15 through 5.3.0, including 5.0.11, 5.1.8, and 5.2.4. Any Moodle site that still includes the Blackboard import format within these version ranges is susceptible.

The CVSS score of 7.1 indicates high severity, and while the EPSS score is unavailable, the lack of listing in CISA’s KEV catalog suggests no widely known exploits yet. The attack vector is inferred to be an authenticated teacher or user with question import or lesson edit rights; thus compromising such an account—through phishing or credential reuse—could enable the upload of malicious ZIP archives. The attack does not require special privileges beyond those already granted to teachers and therefore carries a realistic risk in environments where teacher accounts are not tightly controlled.