ATutor CVE-2026-64968

Exploitation requires a valid ATutor administrator account - the CVSS 4.0 PR:H metric confirms high privilege is necessary and unauthenticated exploitation is not possible. The attack is exercised specifically through ATutor's import functionalities; other application areas are not confirmed as affected. Access to the file:// URI scheme additionally requires that the PHP runtime has allow_url_fopen or equivalent URL wrapper support enabled, which is not the default-off posture on all PHP deployments. Limiting factors: admin-only access significantly restricts the attacker population; impact on the vulnerable system itself is low (VC:N/VA:N); file:// access is conditional on PHP configuration. The primary elevated risk scenario is cloud-hosted deployments where the IMDSv1 metadata endpoint is reachable from the application server.

The CVSS 4.0 score of 5.1 reflects the high privilege requirement (PR:H) that constrains realistic attack surface to compromised or malicious administrators. The subsequent-system impact metrics (SC:L/SI:L/SA:L) are significant: in cloud-hosted deployments, SSRF against the IMDSv1 endpoint at 169.254.169.254 can yield IAM credentials without any additional complexity, amplifying the practical impact well beyond what the base score suggests. No EPSS data was provided, no KEV listing exists, and no POC has been identified, suggesting exploitation has not been observed at scale. However, ATutor is end-of-life with no vendor fix path, meaning the risk profile is static and will not improve over time. The cert.pl reference URL cites CVE-2026-64960 rather than CVE-2026-64968 - this discrepancy should be verified, as it may indicate the advisory covers a family of CVEs or contains a typographic error. The EOL status means even a small organization with ATutor still in production should treat decommissioning as the priority action.

An attacker who has gained ATutor administrator credentials - through credential stuffing, phishing, or a prior compromise - navigates to the import functionality and submits a crafted URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve cloud IAM role credentials from the instance metadata service. No public exploit code has been identified, but the attack requires no special tooling beyond a browser and admin-level access to the ATutor interface.