CVE-2026-64968: Server-Side Request Forgery in ATutor
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable PHP URL wrappers/stream wrapper functionality so that import functionalities cannot use arbitrary URL schemes such as file:// (as the issue requires URL wrappers to perform SSRF to internal HTTP endpoints, cloud metadata services, or local files).
ATutor (PHP environment) URL wrappers / file:// support (PHP stream wrappers) = disable - Configuration
Modify ATutor import functionality to reject/disable import sources that accept URLs or local file schemes (e.g., prevent file:// usage) so the server cannot be forced to request arbitrary internal endpoints or local files.
ATutor import functionality SSRF-capable import URL/file handling = block - Compensating control
Constrain network egress from the ATutor server (firewall/ACL) to prevent server-side requests to internal networks and cloud metadata endpoints, mitigating SSRF impact even if URL wrappers are reachable.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ATutor administrator can exploit the vulnerable import functionality. The issue is therefore primarily relevant where administrative accounts may be compromised, shared, or available to untrusted users.
What internal resources could be reached?
The server can be induced to request arbitrary internal HTTP endpoints and cloud metadata services. It may also access local files through file:// URLs if the PHP environment permits URL wrappers.
Which versions are confirmed affected?
Only ATutor 2.2.4 was tested and confirmed vulnerable. Other versions were not tested and may also be affected.
Is a patch available?
No fix is indicated: ATutor is no longer actively supported and the vulnerabilities have not been fixed.