EUVD-2026-63367
GHSA-qc5h-x7gw-7r79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Instructor-level account (PR:L) suffices; scope changes because RCE escapes the web application boundary to the underlying OS.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
2DescriptionCVE.org
ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a server-executable .phtml file in the web root and achieve remote code execution with web server privileges on the underlying server.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
AnalysisAI
Remote code execution in ATutor 2.2.4 is achievable by any authenticated instructor through a path traversal flaw in the ZIP extraction functionality. An attacker uploads a crafted ZIP archive containing a malicious .phtml file at a directory-traversing path, causing the file to be written into the web root and executed with web server process privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid ATutor instructor-level account - the attack surface is limited to users who have been granted instructor privileges, though ATutor instances may allow self-registration with auto-assigned instructor roles depending on configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scoring 8.7 accurately reflects low-complexity, network-accessible exploitation requiring only instructor-level authentication, with full impact on the vulnerable system's confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis, and none is anticipated given ATutor's end-of-life status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and document all ATutor 2.2.4 instances, instructor user accounts with file upload access, and current usage patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today