File Upload Vulnerability in ATutor Gameme Module from ATutor
CVE-2026-64960

8.7HIGH

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64960?

The ATutor Gameme module contains a serious vulnerability that allows authenticated users to upload files of any type and extension without appropriate restrictions. This flaw arises from improper handling of file uploads, which are stored in a web-accessible directory before their content is properly validated. An attacker with knowledge of a valid course ID can exploit this flaw to upload a server-executable malicious script. Subsequently, this script can be requested via HTTP, leading to remote code execution as the web server process user. It is noteworthy that the commonly used course ID of 0 may offer an attack vector, as it typically represents a global context. The product is no longer actively supported, and while only version 2.2.4 has been confirmed vulnerable, other versions may also be at risk.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.