Loading vulnerability…
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small proof-of-concept and documentation package for CVE-2026-7275, a path traversal/arbitrary file write issue in Moodle's Google Drive repository integration (repository_googledocs). The repo contains mostly markdown documentation (README.md, EXPLOIT.md, PATCH.md, CONTRIBUTORS.md) plus one executable Python demo script at poc/demo_path_traversal.py. There is no full remote exploit automation against a live Moodle target; instead, the repository explains the attack chain and provides a local simulation of vulnerable versus patched path handling. The core exploit capability is arbitrary file write via attacker-controlled Google Drive filename metadata. In vulnerable Moodle versions, repository downloads pass the original filename into prepare_file() without sanitization, allowing traversal strings such as ../../../../public/shell.php or Windows-style backslash variants to escape the temporary request directory. If the attacker can cause the file to be written into a PHP-executable webroot, the arbitrary write can become RCE by dropping a PHP file and then requesting it over HTTP. The documented attack flow is: attacker prepares or renames a Google Drive file with a traversal filename, authenticates to Moodle with a linked Google account, opens the file picker or otherwise triggers repository download through /repository/repository_ajax.php, and relies on Moodle fetching the file from Google Drive via /drive/v3/files/{id}?alt=media. Moodle then joins the unsanitized filename to its temp directory path, which may resolve outside the intended jail. The repo explicitly notes that the filename comes from Google API metadata rather than direct HTTP parameter tampering. The Python script poc/demo_path_traversal.py is the main code artifact. It simulates pre-patch behavior (no sanitization) and post-patch behavior approximating clean_param(..., PARAM_FILE). It constructs candidate paths, resolves them with os.path.realpath, and reports whether each payload escapes the temporary directory. This confirms the vulnerability conceptually but does not contact any network service. The patch analysis explains that Moodle fixed the issue centrally in public/repository/lib.php by wrapping the filename with clean_param($filename, PARAM_FILE) inside prepare_file(). The documentation also identifies affected call sites in public/repository/googledocs/lib.php and notes that the central fix protects other repository plugins using the same helper. Overall, this is a legitimate exploit-analysis repository with a local PoC demonstration and detailed exploitation guidance, but not a weaponized end-to-end exploit tool.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.