VYPR
Vypr IntelligenceAI-generatedAug 20, 2026· 13 CVEs

ATutor: Batch of 13 Vulnerabilities Disclosed, Including RCE in Unsupported LMS

Thirteen vulnerabilities, including two critical for remote code execution, were disclosed in the unsupported ATutor LMS on August 20, 2026.

Key findings

  • Thirteen vulnerabilities disclosed in ATutor on August 20, 2026, including XSS, IDOR, SSRF, and path traversal.
  • Two high-severity path traversal flaws (CVE-2026-64966, CVE-2026-64960) could lead to remote code execution.
  • Product is no longer actively supported, and vulnerabilities remain unpatched.
  • Risks include arbitrary code execution, data access, and authentication bypass.
  • Users are advised to migrate from ATutor due to ongoing security risks.

On August 20, 2026, a batch of thirteen vulnerabilities was disclosed for the ATutor learning management system. These vulnerabilities, all disclosed on the same day, span a range of security issues including cross-site scripting (XSS), insecure direct object reference (IDOR), server-side request forgery (SSRF), path traversal, predictable token generation, and authentication bypass. The most severe of these are two high-severity path traversal vulnerabilities, one in ZIP extraction functionality and another in the Gameme module, which could allow for remote code execution.

Several vulnerabilities leverage cross-site scripting (XSS) to execute arbitrary JavaScript in a victim's browser. CVE-2026-64972, a reflected XSS flaw in preview.php, allows an attacker to inject code via the popup parameter. Similarly, CVE-2026-64971, found in the restore functionality, can be exploited through a crafted URL. A stored XSS vulnerability, CVE-2026-64970, exists in the registration functionality, where a malicious payload in the phone field can be executed when an attacker's profile is viewed. Another XSS vulnerability, CVE-2026-64962, is a CSRF flaw in the profile update functionality, enabling attackers to trick authenticated users into submitting forged requests.

Insecure Direct Object Reference (IDOR) and authorization bypass issues present further risks. CVE-2026-64969 allows any authenticated user to delete other users' profile pictures by manipulating requests to the profile album endpoint. CVE-2026-64965 demonstrates a missing authorization check on test and question import endpoints, enabling low-privileged users to import unauthorized content. CVE-2026-64961 details an authentication bypass in the auto-login functionality, where an attacker can generate a valid token by predicting user identifiers and registration timestamps.

Path traversal vulnerabilities are a significant concern within this batch. CVE-2026-64966, a high-severity flaw in ZIP extraction, allows an instructor to upload a crafted ZIP archive to write server-executable files outside the intended directory. CVE-2026-64967, also a path traversal, affects the error log viewer, permitting administrative users to access arbitrary files. CVE-2026-64963, another path traversal, enables authenticated users to access files from other course directories if AT_FORCE_GET_FILE is enabled.

Additionally, CVE-2026-64968, a Server-Side Request Forgery (SSRF) vulnerability, allows authenticated administrators to make the server request arbitrary internal HTTP endpoints or local files. CVE-2026-64964 highlights predictable email confirmation tokens due to insufficient randomness, allowing attackers to guess valid account activation tokens. Finally, CVE-2026-64960, a high-severity vulnerability in the ATutor Gameme module, allows authenticated attackers to upload and execute arbitrary files by bypassing content validation.

Notably, the product is described as no longer actively supported, and the vulnerabilities have not been fixed. This lack of support and patching means that users of ATutor, particularly version 2.2.4 which was tested for CVE-2026-64971, remain exposed to these risks. The wide range of vulnerabilities, including those allowing for remote code execution and sensitive data access, poses a significant threat to educational institutions using ATutor.

The disclosed vulnerabilities include:

Given that ATutor is no longer actively supported and these vulnerabilities remain unpatched, administrators are strongly advised to migrate to a different platform or implement significant compensating controls if continued use is unavoidable. The potential for remote code execution and widespread data compromise makes this a critical situation for any organization still relying on ATutor. The lack of active development means future security issues are unlikely to be addressed.

AI-written article. Grounded in 13 CVE records listed below.
ATutor: Batch of 13 Vulnerabilities Disclosed, Including RCE in Unsupported LMS · VYPR