Moodle CVE-2025-62396

Exploitation requires a Moodle deployment where specific HTTP headers are not properly configured; under that condition the r.php router's error-handling path renders internal directory listings to the requester. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, a remote attacker needs no authentication and no user interaction, but the decisive limiting factor is the header misconfiguration - instances with correctly configured HTTP headers are not expected to expose the listings, which substantially narrows real-world exposure below what the raw 5.3 score suggests. Impact is limited to disclosure of internal directory/file structure (C:L), with no integrity or availability effect.

This is a genuinely moderate-to-low priority issue, and the signals agree rather than conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a remotely reachable, unauthenticated information-disclosure flaw with only low confidentiality impact and no integrity or availability effect - consistent with CWE-548 (exposure of information through directory listing). The EPSS score of 0.30% (23rd percentile) indicates low predicted exploitation likelihood, there is no CISA KEV listing (so no evidence of active exploitation), and no public exploit code is identified in the input. The vendor priority label is 'this_month', which aligns with a non-emergency but still schedulable fix rather than an act-now situation. The one nuance worth verifying: the flaw manifests only 'when specific HTTP headers were not properly configured', meaning real-world exposure depends on deployment configuration rather than being universal against default installs - this is not captured by the CVSS vector and should be confirmed against your own Moodle/reverse-proxy header configuration. No SSVC decision-point data (automatable/technical impact) was supplied, so that framework cannot be applied here.

A remote, unauthenticated attacker sends HTTP requests to the Moodle router endpoint (r.php) on an instance where the expected HTTP headers are not properly configured, causing the error-handling path to render an internal directory listing. The attacker uses the exposed file and directory names to map the application's internal structure and inform further reconnaissance. No public exploit code is identified for this issue at the time of analysis.