CVE-2026-64963 in ATutor
Summary
by MITRE • 08/20/2026
A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in ATutor represents a critical path traversal flaw that exploits improper validation of user-supplied input within the application's file handling mechanisms. Specifically, this issue arises when the configuration option AT_FORCE_GET_FILE is enabled, which alters how the system processes requests for external resources. Under normal circumstances, authenticated users should only have access to files associated with their enrolled courses or permitted public directories. However, due to insufficient sanitization of path parameters, an attacker can manipulate these inputs to traverse directory boundaries. By utilizing standard traversal sequences such as dot-dot-slash (../) in the request payload, a malicious actor can redirect file retrieval operations away from the intended course-specific root directory and into arbitrary locations on the server's filesystem. This flaw effectively bypasses the application-level access controls that are designed to isolate user data, allowing an authenticated individual to read files outside their authorized scope.
The operational impact of this vulnerability is significant, primarily centering on unauthorized information disclosure and potential compromise of system integrity. Because ATutor often stores sensitive configuration files, database credentials, or other administrative scripts in directories above the web root or within course-specific folders that contain private materials, an attacker can extract these contents. The exposure of filesystem structure details provides reconnaissance data that can facilitate further attacks, such as identifying specific software versions installed on the server or locating additional entry points for privilege escalation. Furthermore, if sensitive user data like personal identifiable information (PII) is stored in accessible directories, this leads to direct privacy violations and compliance failures under regulations such as GDPR or HIPAA, depending on the nature of the institution using ATutor. The ability to read arbitrary files also increases the risk of remote code execution if an attacker can locate and view source code containing hardcoded secrets or inject malicious content into writable configuration files for later exploitation.
From a technical classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that could resolve to unintended directories. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques under T1083: File and Directory Discovery, as it allows an adversary to enumerate and access files on a compromised system. The exploitation requires authentication, which places it in the Initial Access or Persistence phases depending on whether the accessed data is used for further lateral movement or long-term control. Since the vulnerability relies on configuration settings being enabled, it highlights the importance of secure default configurations and rigorous input validation practices during software development.
Mitigation strategies are complicated by the fact that ATutor is no longer actively supported and these vulnerabilities have not been patched in subsequent versions. Consequently, traditional patching through vendor updates is not an option for version 2.2.4 or other potentially affected releases. The most effective immediate mitigation involves disabling the AT_FORCE_GET_FILE configuration option if it is currently enabled, as this removes the specific code path that facilitates the traversal attack. Administrators should also enforce strict file permissions on the server hosting ATutor to ensure that even if a traversal occurs, sensitive files such as database config.php or system binaries are not readable by the web server process user (e.g., www-data). Implementing a Web Application Firewall with rulesets capable of detecting and blocking path traversal patterns can provide an additional layer of defense. Long-term resolution requires migrating to a supported learning management system that receives regular security updates, as relying on legacy software without vendor support poses unacceptable risks in modern cybersecurity environments.