Path Traversal Vulnerability in ATutor Affected by Configuration Option
CVE-2026-64963

2.3LOW

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64963?

A path traversal vulnerability exists in ATutor that enables authenticated users to access files from other course directories when the AT_FORCE_GET_FILE setting is enabled. This flaw can result in unauthorized access to sensitive files and expose critical information about the underlying filesystem structure. As ATutor 2.2.4 is the only version confirmed to be vulnerable, users of this version should take immediate action to assess their security posture and mitigate potential risks.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.