EUVD-2026-63360
GHSA-j7vw-j75m-9xfj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable upload endpoint exploitable by any authenticated low-privilege user (PR:L); full RCE on web server process warrants C:H/I:H/A:H with no scope change beyond the application boundary.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course_id can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, course_id=0 can be used, as it commonly represents the global context.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Unrestricted file upload in the ATutor Gameme module allows any authenticated user to achieve remote code execution on the web server. The module stores uploaded files in a web-accessible directory before validating their content or type, meaning a malicious server-executable script (e.g., PHP webshell) can be uploaded and immediately retrieved via HTTP to trigger execution as the web server process user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid authenticated ATutor account - any low-privilege user account suffices, as confirmed by PR:L in the CVSS 4.0 vector; no administrative or instructor role is needed; (2) the Gameme module must be installed and active on the ATutor instance; (3) course_id=0 (the global context) is reported to work in most deployments, meaning the attacker does not need enrollment in a specific course - however, any known valid course_id also suffices; (4) the web server must be configured to execute server-side scripts in the upload directory, which is the default for PHP-based ATutor deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (High) with AV:N/AC:L/AT:N/PR:L/UI:N reflects a straightforward network-exploitable flaw requiring only a valid user account - a realistic bar for any multi-tenant LMS instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is available and none is expected, as ATutor is end-of-life. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running ATutor 2.2.4 and restrict network access to the Gameme module via firewall or WAF rules blocking upload functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today