CVE-2020-25630: 
PHP vulnerability analysis and mitigation

A vulnerability was discovered in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This vulnerability affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. The issue was fixed in versions 3.9.2, 3.8.5, 3.7.8 and 3.5.14 (Moodle Forum).

The vulnerability has been assigned CVE-2020-25630 and received a CVSS v3.1 base score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue stems from improper validation of zip file sizes before decompression, which could be exploited through the file picker functionality (NVD).

The vulnerability could allow attackers to cause a denial of service condition by exploiting the lack of zip file size validation against user quotas during the decompression process (NVD).

The vulnerability can be exploited remotely without requiring authentication or user interaction, as indicated by the CVSS metrics showing Network access vector (AV:N) with Low attack complexity (AC:L) and No privileges required (PR:N) (NVD).

The recommended mitigation is to upgrade to the fixed versions: 3.9.2, 3.8.5, 3.7.8 or 3.5.14, depending on the installed branch (Moodle Forum).