Directory Traversal

moodle/moodle is vulnerable to directory traversal. It does not validate the path used to import a lesson question, allowing an authorized user to cause an arbitrary file read via this feature...