CVE-2015-2267

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-06-01 · updated 2026-06-17
Weakness: CWE-284

Description

mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.

Affected products

Moodle: through 2.5.9; 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5 (+22)

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087
http://openwall.com/lists/oss-security/2015/03/16/1
https://moodle.org/mod/forum/discuss.php?d=307381
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087
http://openwall.com/lists/oss-security/2015/03/16/1
https://moodle.org/mod/forum/discuss.php?d=307381

Get alerted when CVE-2015-2267 or the next vulnerability affects your stack