Server-Side Request Forgery in ATutor Affected by Internal Request Vulnerability
CVE-2026-64968

5.1MEDIUM

Key Information:

Vendor

Atutor

Status
Atutor
Vendor
CVE Published:
20 August 2026

What is CVE-2026-64968?

ATutor, a learning management system, has a vulnerability that allows authenticated administrators to perform server-side request forgery (SSRF) through its import functionalities. This flaw enables the execution of arbitrary internal HTTP requests, access to cloud metadata services, or the retrieval of local files if the PHP environment is configured to allow URL wrappers. Notably, only version 2.2.4 has been confirmed as vulnerable, with other versions potentially affected as the product is no longer actively supported and vulnerabilities remain unpatched.

Affected Version(s)

ATutor 2.2.4

References

https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://atutor.github.io/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michał Majchrowicz (AFINE Team)
Marcin Wyczechowski (AFINE Team)
.