CVE-2012-6099
Moodle Arbitrary File Read via Backup Functionality
CVE-2012-6099 is a medium vulnerability (CVSS 4.0) in Moodle, published January 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in moodle/moodle 2.4.1.
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
Exploit likelihood
What each source reports
NVD Score used
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
CVE-2012-6099- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
CVE-2012-6099- Updated
- 2026-11-02
EUVDEUVD-2022-3622 No score
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
EUVD-2022-3622- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cr78-rphw-w73p No score
Moodle Arbitrary File Read via Backup Functionality
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
GHSA-cr78-rphw-w73p- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-cr78-rphw-w73p No score
Moodle Arbitrary File Read via Backup Functionality
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
GHSA-cr78-rphw-w73p- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-6099 No score
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
- Record
UBUNTU-CVE-2012-6099- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.4 to 2.4 | 2.4.1 |
moodle/moodlePackagist |
2.3 to 2.3.3 | 2.3.4 |
moodle/moodlePackagist |
2.2 to 2.2.6 | 2.2.7 |
moodle/moodlePackagist |
2.1 to 2.1.9 | 2.1.10 |
moodle/moodlePackagist |
2.4 up to 2.4.1, plus listed versions v2.4.0v2.4.0-rc1 |
2.4.1 |
moodle/moodlePackagist |
2.3 up to 2.3.4 | 2.3.4 |
moodle/moodlePackagist |
2.2 up to 2.2.7 | 2.2.7 |
moodle/moodlePackagist |
2.1 up to 2.1.10 | 2.1.10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36977
moodle.org/mod/forum/discuss.php?d=220160
openwall.com/lists/oss-security/2013/01/21/1
nvd.nist.gov/vuln/detail/CVE-2012-6099
github.com/moodle/moodle/commit/0ab681d3e7bed2a37430387f9da8504c0b077d10