CVE-2026-64960 in ATutor
Summary
by MITRE • 08/20/2026
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course_id can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, course_id=0 can be used, as it commonly represents the global context.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability in question resides within the Gameme module of ATutor, an open-source web-based learning management system that has reached its end-of-life status and is no longer actively supported by its developers. This specific flaw stems from a critical failure in input validation logic related to file upload operations. The application permits authenticated users to submit files for storage without enforcing restrictions on the file type or extension allowed during the initial ingestion phase. Crucially, the system stores these uploaded files in web-accessible directories before performing any content-based security checks. This architectural decision creates a race condition-like scenario where malicious payloads can be executed by an attacker even if subsequent validation steps might theoretically reject them, as execution occurs prior to that rejection or because the validation is entirely bypassed for certain contexts.
From a technical perspective, this flaw constitutes a classic Unrestricted File Upload vulnerability, which aligns with CWE-434 in the Common Weakness Enumeration taxonomy. The core issue lies in the improper handling of user-supplied data where the system fails to validate the file content against a strict allowlist or denylist before making it accessible via HTTP requests. Because the files are placed directly into directories served by the web server, an attacker can upload a script written in languages such as PHP, Python, or Perl that contains malicious code designed for remote execution. The lack of extension filtering means there is no mechanism to prevent the web server from interpreting these uploaded scripts as executable content rather than static data files like images or documents.
The operational impact of this vulnerability is severe, leading directly to Remote Code Execution (RCE) under specific conditions. An attacker who possesses valid authentication credentials for ATutor can exploit this flaw by crafting a malicious script and uploading it through the Gameme module interface. To successfully execute the payload, the attacker must know or guess a valid course_id parameter. In many default configurations of ATutor, using course_id=0 is sufficient because it typically refers to the global context where uploaded files are stored in publicly accessible paths. Once the malicious script is uploaded and its location identified via HTTP requests, the web server process executes the code with the privileges assigned to that service account. This effectively grants the attacker full control over the underlying operating system to the extent of the web server user's permissions, allowing for data exfiltration, persistence mechanisms, lateral movement within the network, or complete compromise of the hosting infrastructure.
This attack vector is well-documented in cybersecurity frameworks and maps closely to MITRE ATT&CK techniques related to Initial Access via Valid Accounts and Execution via Web Shell Deployment. The ability to upload a web shell represents a significant escalation from mere unauthorized access to full system compromise. Given that ATutor version 2.2.4 has been confirmed as vulnerable and the product is no longer supported, there are no official patches available to remediate this issue within the software itself. Organizations still running affected versions face substantial risk unless they implement compensating controls at the infrastructure level.
Mitigation strategies for this vulnerability must focus on environmental hardening since code-level fixes are unavailable. The most effective immediate action is to upgrade or migrate away from ATutor entirely, as continued use of unsupported legacy software poses an unacceptable security risk in modern threat landscapes. If migration is not immediately feasible, administrators should restrict file upload capabilities by disabling the Gameme module if it is not essential for business operations. Additionally, web server configurations can be hardened to prevent execution of scripts within user-upload directories. This involves configuring directives such as DisableExec or equivalent settings depending on whether Apache, Nginx, or IIS is in use, ensuring that uploaded files are treated strictly as static content and never interpreted by the interpreter engine. Implementing strict file type validation at a reverse proxy level before requests reach the application can also provide an additional layer of defense against unrestricted uploads.