Moodle SpellChecker Path Authenticated RCE (CVE-2021-21809)

Moodle allows an authenticated administrator to define spellcheck settings via the web interface. An administrator can update the aspell path to include a command injection similar to CVE-2013-3630. Requires admin credentials. Tested against Moodle 3.11.2, 3.10.0, 3.8.0. !/usr/bin/env python3 --...