CVE-2026-64963: Path Traversal in ATutor
A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the ATFORCEGETFILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the AT_FORCE_GET_FILE configuration option in ATutor to prevent authenticated path traversal across course directories.
ATutor AT_FORCE_GET_FILE = disabled - Compensating control
Because ATutor is no longer actively supported and the vulnerability has not been fixed, place additional compensating controls around the application (e.g., restrict access to ATutor and tightly control which authenticated users can access course content) to reduce exposure to unauthorized file access.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to ATutor. The issue allows that user to access files located in other course directories when the affected configuration option is enabled.
Is a default installation affected?
The vulnerability is described as requiring AT_FORCE_GET_FILE to be enabled. The provided information does not state whether this option is enabled by default.
Which versions are known to be vulnerable?
Only ATutor 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be affected.
What can be done if no patch is available?
The product is no longer actively supported and the vulnerabilities have not been fixed. Disabling AT_FORCE_GET_FILE removes the stated condition required for exploitation.