CVE-2025-34031: geoffrowland jmol Path Traversal

Vulnerability summary

CVE-2025-34031 is a high (CVSS 8.7) Path Traversal vulnerability in geoffrowland jmol. EPSS estimates a 3.06% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 24-06-2025
   PublishedVulnerability first disclosed.
2. 14-05-2026
   Last modifiedVulnerability information updated.

Description

A path traversal vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the query parameter in jsmol.php. The script directly passes user input to the file_get_contents() function without proper validation, allowing attackers to read arbitrary files from the server's filesystem by crafting a malicious query value. This vulnerability can be exploited without authentication and may expose sensitive configuration data, including database credentials. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.