EUVD-2026-63360
GHSA-j7vw-j75m-9xfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privilege ATutor credentials
-
DeliveryPOST PHP webshell to Gameme upload endpoint with course_id=0
-
ExploitFile stored in web-accessible directory without validation
-
ExecutionSend HTTP GET request to uploaded file path
-
PersistWeb server executes script as process user
-
ImpactAttacker gains remote shell
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid authenticated ATutor account - any low-privilege user account suffices, as confirmed by PR:L in the CVSS 4.0 vector; no administrative or instructor role is needed; (2) the Gameme module must be installed and active on the ATutor instance; (3) course_id=0 (the global context) is reported to work in most deployments, meaning the attacker does not need enrollment in a specific course - however, any known valid course_id also suffices; (4) the web server must be configured to execute server-side scripts in the upload directory, which is the default for PHP-based ATutor deployments. Exploitation is not possible without authentication. Unauthenticated access is not described and is not supported by the PR:L CVSS metric. |
| Impact | The CVSS 4.0 base score of 8.7 (High) with AV:N/AC:L/AT:N/PR:L/UI:N reflects a straightforward network-exploitable flaw requiring only a valid user account - a realistic bar for any multi-tenant LMS instance. Full impact metrics (VC:H/VI:H/VA:H) are consistent with complete RCE on the web server process, while secondary system impact (SC:L/SI:L/SA:L) signals limited lateral risk. No EPSS score or CISA KEV listing was provided; no public exploit has been identified at time of analysis, though the primitive (unrestricted upload to web-accessible path) is trivially reproducible by any developer familiar with the technique. The absence of a patch - and the vendor's confirmed EOL status - transforms this from a patchable risk into a permanent exposure for any organization still running the software; even a small municipal IT team running a legacy e-learning platform should treat this as grounds for immediate decommission or module-level mitigation rather than deferral. |
| Exploit ScenarioDerived | An authenticated ATutor user navigates to the Gameme module upload endpoint and submits a PHP webshell file using course_id=0, which maps to the global context available by default. The file is written to a web-accessible directory without type validation, and the attacker immediately sends an HTTP GET request to the stored file's URL. The web server executes the script as its process user (typically www-data), granting the attacker an interactive remote shell. No public exploit code has been identified at time of analysis, but the technique requires no sophisticated tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Unrestricted file upload in the ATutor Gameme module allows any authenticated user to achieve remote code execution on the web server. The module stores uploaded files in a web-accessible directory before validating their content or type, meaning a malicious server-executable script (e.g., PHP webshell) can be uploaded and immediately retrieved via HTTP to trigger execution as the web server process user. ATutor 2.2.4 is confirmed vulnerable; the product is end-of-life with no patch available or planned.
RemediationAI
No vendor-released patch is available and none is expected, as ATutor is end-of-life. The primary remediation is migration to an actively maintained LMS alternative; this is the only complete fix. If immediate migration is not feasible, disable or remove the Gameme module entirely to eliminate the upload endpoint - this removes gamification features but closes the attack surface. As a compensating control, configure the web server to deny execution of server-side scripts (e.g., PHP) within upload directories, which prevents webshell execution even if files are uploaded; note this requires correct per-directory web server configuration and does not prevent file storage. Additionally, restrict ATutor access to trusted network ranges via firewall or reverse proxy to limit the pool of potential authenticated attackers. Minimize the number of active user accounts and audit existing ones. Refer to the cert.pl advisory at https://cert.pl/en/posts/2026/08/CVE-2026-64960 for additional context.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ATutor is an open-source Learning Content Management System (LCMS). The Gameme module within ATutor implements a file upload feature that fails to enforce restrictions on file type or extension (CWE-434: Unrestricted Upload of File with Dangerous Type). The root cause is that uploaded files are written to a web-accessible storage location before any content validation is performed - a design flaw that allows the web server to serve and execute the uploaded file as a server-side script. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network accessibility with low attack complexity and no specific attack requirements beyond a low-privilege authenticated session. The course_id parameter, which scopes uploads, defaults to 0 for a global context, meaning no course-specific enrollment is required in most deployments. No CPE string was provided in the reference data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Network-reachable upload endpoint exploitable by any authenticated low-privilege user (PR:L); full RCE on web server process warrants C:H/I:H/A:H with no scope change beyond the application boundary.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
DescriptionCVE.org
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course_id can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, course_id=0 can be used, as it commonly represents the global context.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Executive ViewAI
ATutor's Gameme module (version 2.2.4, end-of-life) permits authorized users to upload and execute malicious code on web servers, creating risk of data breach, service disruption, and unauthorized access to student and faculty information. Organizations running ATutor face immediate exposure with no vendor patch available to remediate the vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to Gameme module via network firewall or WAF; disable PHP execution in upload directories through web server configuration (.htaccess or nginx rules); implement role-based access controls limiting upload permissions; enforce strict file type validation on all uploads; disable or uninstall the Gameme module; establish file system monitoring for suspicious executable uploads; conduct regular forensic audits of upload directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB