EUVD-2026-63363
GHSA-5rmr-hv98-xf8x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Non-default AT_FORCE_GET_FILE prerequisite raises AC to H; authenticated low-privilege required; read-only low-confidentiality impact only.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Path traversal in ATutor 2.2.4 enables an authenticated low-privilege user to read files belonging to other course directories when the AT_FORCE_GET_FILE configuration option is active, leaking file contents and exposing filesystem structure. The product is end-of-life with no vendor-released patch, making remediation dependent entirely on compensating controls or decommissioning. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: (1) the attacker must hold a valid authenticated session in ATutor with at least low-privilege access (a standard course enrollment suffices), and (2) the AT_FORCE_GET_FILE configuration option must be explicitly enabled - this is a non-default setting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.3 reflects the constrained nature of this vulnerability: network-accessible (AV:N), but requiring an authenticated low-privilege session (PR:L) and a specific non-default configuration prerequisite (AT:P - AT_FORCE_GET_FILE enabled). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch exists and none is expected, as ATutor is end-of-life. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today