A Remote Code Execution vulnerability exists in Moodle’s file restore functionality due to insufficient validation of backup file contents during the restore process. An authenticated user with restore permissions can upload a specially crafted Moodle backup archive that may trigger execution of arbitrary PHP code when processed by the server. Successful exploitation could result in complete compromise of the Moodle instance, including unauthorized access to data, system modification, or service disruption.