CVE-2026-64960: Remote Code Execution via Unrestricted File Upload in ATutor
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, courseid=0 can be used, as it commonly represents the global context.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and know a valid course_id. In many deployments, course_id=0 may work because it commonly represents the global context.
What conditions are required for code execution?
The attacker needs to upload a server-executable malicious script and then request that uploaded file over HTTP. Code executes with the permissions of the web server process user.
Is a patched release available?
No fix is identified in the available information. The product is no longer actively supported, and the reported vulnerabilities have not been fixed.
Which versions are known to be affected?
Only ATutor version 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be vulnerable.