A flaw in Moodle’s backup restore functionality permits an attacker to craft a malicious backup file that bypasses validation checks, potentially leading to unintended execution of server-side code when the file is processed. The vulnerability can fully compromise a Moodle server, exposing its configuration, user data, and any integrated applications to an attacker.

All Moodle deployments that have the backup restore feature enabled are potentially affected; specific version information is not provided, so all current releases should be considered at risk.

The CVSS score of 7.2 indicates a high risk of exploitation, while the EPSS score of less than 1% reflects a low probability of known activity, though the vulnerability still exists. Because the backup restore function is usually available only to privileged users, successful exploitation requires authenticated access, likely via the Moodle web interface. The vulnerability can lead to complete compromise of the server by executing arbitrary code, thereby affecting confidentiality, integrity, and availability.