What is the CVSS score of EUVD-2025-18971?

EUVD-2025-18971 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 12.2%.

Is there a public PoC exploit available for EUVD-2025-18971?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18971. Prioritise patching immediately. EPSS: 12.2%.

How to fix or mitigate EUVD-2025-18971?

Within 24 hours: Identify all Moodle instances running Jmol plugin 6.1 or earlier and immediately disable the plugin if not operationally critical; apply WAF rules to block malicious query parameters to jsmol.php. Within 7 days: Conduct a comprehensive audit of file access logs to determine if exploitation occurred and review database credentials for any unauthorized access. Within 30 days: Upgrade Moodle and the Jmol plugin to patched versions when available, and perform full security assessment of affected systems.

Moodle EUVD-2025-18971

| CVE-2025-34031 HIGH

Path Traversal (CWE-22)

2025-06-24 disclosure@vulncheck.com

PHP Information Disclosure Path Traversal Moodle Jmol

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 7.5, EPSS 12.2%, PoC available. Moodle is the world's most widely used LMS. The Jmol plugin (for 3D molecular visualization) is installed in many educational institutions. config.php exposure gives database access to student records and grades.
Exploit ScenarioDerived	An attacker sends a request to jsmol.php?query=../../../config.php. The file contents are returned, revealing database credentials. The attacker connects to the Moodle database and extracts student personal information, grades, and course materials.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

No patch listed yet 12.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

The Moodle LMS Jmol plugin version 6.1 and earlier contains a path traversal vulnerability in jsmol.php. The query parameter is passed directly to file_get_contents() without validation, allowing unauthenticated attackers to read arbitrary files from the Moodle server including configuration files with database credentials.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 22:36 CVSS 7.5

Unauthenticated path traversal in Moodle Jmol plugin enables arbitrary file read including database credentials.

RemediationAI

Remove or update the Jmol plugin. Implement path validation in jsmol.php. Rotate database credentials. Review Moodle access logs for path traversal attempts.

Affected VersionsENISA

Jmol Plugin 0 ≤6.1

Affected Packages

euvd jmol_plugin no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The jsmol.php script passes the query parameter directly to file_get_contents() without path sanitization. An attacker can traverse directories to read any file accessible to the web server process, including Moodle's config.php which contains database credentials, secret keys, and LDAP configuration.

Know when Moodle gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Nov 20, 2025 - 22:15 vuln.today

Public exploit code

CVE Published

Jun 24, 2025 - 01:15 nvd

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

Executive ViewAI

Why It Matters

Moodle LMS installations using the Jmol plugin version 6.1 or earlier are vulnerable to unauthenticated file disclosure attacks that could expose sensitive data including database credentials. This vulnerability is actively being exploited in the wild and poses an immediate risk to any organization relying on Moodle for learning management, potentially compromising the confidentiality of user data and system integrity.

Business Impact: High

Compensating Controls

Disable the Jmol plugin entirely if not essential to operations; implement Web Application Firewall (WAF) rules to block path traversal patterns and suspicious query parameters to jsmol.php; restrict network access to Moodle administrative interfaces using IP whitelisting; monitor file access logs for unauthorized read attempts; rotate database credentials immediately and implement database access controls; segment Moodle instances from critical infrastructure.

Threat Intelligence Overview

EPSS Score

12.2%

Top 6% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS POC (1)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 12.2%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +12

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.