exdev994/cve-2026-7275-moodlePoC & dokumentasi untuk CVE-2026-7275: Moodle Google Drive Repository (repository_googledocs) — Path Traversal / Arbitrary File Write yang dapat mengarah ke RCE pada versi Moodle yang belum dipatch.
PoC & documentation for CVE-2026-7275: Moodle Google Drive Repository (repository_googledocs) — Path Traversal / Arbitrary File Write that can lead to RCE on unpatched Moodle versions.
Disclaimer: For authorized security research, auditing, and defensive education only. Do not use on systems without written permission.
| Field | Value |
|---|
| CVE | CVE-2026-7275 |
| Advisory | MSA-26-0006 |
| Tracker | MDL-88423 |
| Component | repository_googledocs |
| CWE | CWE-22 (Path Traversal) |
| Severity | Critical (CVSS ~9.1) |
| Affected | Moodle 5.1.0–5.1.3, 5.0.0–5.0.6, 4.5.0–4.5.10 |
| Fixed in | 5.1.4, 5.0.7, 4.5.11 |
The Google Drive plugin in Moodle downloads files from the Google API using the file name metadata ($originalfile->name). Before the patch, this name was passed to prepare_file() without sanitization, allowing payloads like ../../../../public/shell.php to write files outside the temp directory → potential RCE if the webroot executes PHP.
No need to know absolute path — just relative traversal (repeated ../) from random temp folder.
├── README.md ← summary (this file)
├── CONTRIBUTORS.md ← 0xNuts + Cursor
├── EXPLOIT.md ← attack chain, payload, prerequisites
├── PATCH.md ← patch analysis & mitigations
└── poc/
└── demo_path_traversal.py ← local demo pre-patch vs post-patch
python poc/demo_path_traversal.py
Output shows ESCAPE (pre-patch) vs contained (post-patch) paths.
| Prerequisite | Detail |
|---|---|
| Moodle account | Authenticated user |
| Capability | repository/googledocs:view |
| OAuth | Google Drive linked to Moodle user |
| Plugin | repository_googledocs active |
| Version | Unpatched (< 5.1.4 / < 5.0.7 / < 4.5.11) |
// public/repository/lib.php — prepare_file()
return sprintf('%s/%s', make_request_directory(), clean_param($filename, PARAM_FILE));
Full details: PATCH.md
| 0xNuts | @ExDev994 — lead researcher, PoC, documentation |
| Cursor | cursor.com — co-researcher, static analysis, exploit & patch write-up |
Details: CONTRIBUTORS.md
/*
* CVE-2026-7275 — break to understand, patch to defend.
* Contributors: 0xNuts (@ExDev994) + Cursor
*/