CVE-2026-64968 in Atutor
Summary
by MITRE • 08/20/2026
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in ATutor represents a critical Server-Side Request Forgery (SSRF) flaw located within its import functionalities. This security weakness allows an authenticated administrator to manipulate the application into making HTTP requests to arbitrary destinations controlled by the attacker. The core technical issue stems from insufficient validation of user-supplied input when processing imported files or configurations. Instead of restricting the scope of network connections to expected internal endpoints, the software passes these inputs directly to PHP's URL handling mechanisms without adequate sanitization. This lack of rigorous input verification creates a pathway for an adversary to redirect server-side requests toward unintended targets, fundamentally breaking the principle that administrative functions should be confined to their intended operational boundaries.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and internal network reconnaissance. An attacker with administrator privileges can leverage this flaw to probe internal services that are not exposed to the public internet, such as database servers, management interfaces, or other microservices running on the same host or within the local subnet. Furthermore, by utilizing specific URL schemes like file://, an authenticated user may be able to read sensitive files from the server's filesystem if the PHP environment permits URL wrappers and has appropriate permissions. This capability extends beyond simple network scanning; it enables direct access to configuration files, credential stores, and other critical system resources that reside on disk but are not meant to be accessed via web application interfaces.
The risk is significantly amplified by the fact that ATutor is no longer actively supported, meaning there are no official patches or security updates available to remediate this issue. The vulnerability has been confirmed in version 2.2.4, and while other versions were not explicitly tested, they likely share the same underlying architectural flaws given the age of the software and its lack of maintenance. This absence of vendor support leaves organizations relying on ATutor with no straightforward technical fix from the developer, forcing them to rely entirely on external mitigation strategies or application migration. The persistence of this vulnerability in an unsupported product line highlights a common risk where legacy systems continue to operate despite known critical weaknesses that have remained unaddressed for extended periods.
To mitigate these risks, organizations must implement strict network-level controls since code-level remediation is not possible. Deploying web application firewalls or reverse proxies with SSRF protection rules can help block outbound requests from the ATutor server to internal IP ranges and cloud metadata service endpoints such as 169.254.169.254, which are commonly targeted in SSRF attacks for credential theft. Additionally, restricting PHP's allow_url_fopen directive or disabling specific URL wrappers can prevent the exploitation of file:// protocols if they are not strictly required by other legacy functionalities. It is also advisable to isolate ATutor within a restricted network segment with limited outbound connectivity and to plan for migration to a supported learning management system that receives regular security updates and maintains active vulnerability management practices.
From an industry standard perspective, this vulnerability aligns closely with CWE-918, which describes Server-Side Request Forgery flaws where the web server makes requests based on user input without proper validation. The attack vector also maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer scenarios where an attacker uses compromised credentials to pivot through internal networks and access sensitive resources that are not directly accessible from the internet. Understanding these mappings helps security teams contextualize the threat within broader attack chains and prioritize defensive measures accordingly. The combination of authenticated privilege abuse, lack of input validation, and reliance on potentially dangerous PHP features creates a high-severity risk profile that demands immediate attention through compensating controls despite the software's end-of-life status.