CVE-2024-43426

What it actually does

Insufficient input sanitization in the TeX notation filter allows path traversal that results in arbitrary file reads when pdfTeX processes attacker-controlled content.

Why it matters to the business

Attackers may read sensitive server files such as configuration data or user information, increasing risk of data exposure on any Moodle instance with pdfTeX available.

How an attack unfolds

An attacker submits specially crafted TeX notation through Moodle features that invoke pdfTeX; the missing sanitization permits directory traversal sequences that cause pdfTeX to read and return arbitrary files from the underlying filesystem.

How to fix it

Upgrade moodle/moodle to commit aea9770cfc7d003a737f4899489d1e3982efe9ac or later; disable pdfTeX integration if the update cannot be applied immediately.

How to confirm the fix worked

Confirm the deployed codebase contains commit aea9770cfc7d003a737f4899489d1e3982efe9ac; test the TeX filter with known traversal payloads to verify reads are now blocked.

Typical attack path

1. Identify Moodle instance with pdfTeX/TeX Live enabled
2. Craft malicious TeX input containing path traversal sequences
3. Submit input via any interface that invokes the TeX notation filter
4. Observe or exfiltrate contents of arbitrary files returned by pdfTeX

How to detect it

Search web server and application logs for TeX filter invocations containing path traversal patterns such as ../ or absolute paths; inspect pdfTeX process output or temporary files for unexpected file contents.

What your security team should do

• Apply the fixed commit aea9770cfc7d003a737f4899489d1e3982efe9ac immediately
• Review logs for any prior TeX filter usage that may indicate attempted exploitation
• Restrict or disable pdfTeX on instances that do not require it
• Monitor EPSS trend and re-evaluate risk if exploitation maturity changes