Path Traversal Vulnerability in ATutor by A Tutor Team
CVE-2026-64966

8.7HIGH

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64966?

ATutor has a vulnerability related to its ZIP extraction functionality, which permits attackers with instructor privileges to upload malicious ZIP files. This flaw allows the extraction of files outside the intended directory, enabling an attacker to place executable .phtml files in the web root. As a result, the attacker can achieve remote code execution with the privileges of the web server, posing a significant risk to server integrity and security. The vulnerability has been confirmed in version 2.2.4, and while other versions may also be at risk, they have not been explicitly tested for this vulnerability.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.