Moodle Portfolio forum caller class allows a user to download any file

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

Unauthorised Arbitrary File Downloads

Moodle is vulnerable to unauthorised arbitrary file downloads. It is possible because any authorized student with access to portfolio forum caller class can change the download URL to download any files...