Loading story…
CERT Polska disclosed 13 vulnerabilities in ATutor 2.2.4 tracked as CVE-2026-64960 through CVE-2026-64972, warning that the unsupported learning management platform is affected by multiple high-impact weaknesses with no available fixes. The issues include unrestricted file upload, authentication bypass, CSRF, path traversal, predictable account activation tokens, missing authorization, SSRF, IDOR, and stored and reflected XSS. CERT Polska said the flaws can be chained to achieve remote code execution, administrator account compromise, arbitrary file access, unauthorized content import, and profile manipulation.
One of the most serious issues involves unrestricted upload of dangerous file types, a weakness aligned with CWE-434, in which an application accepts executable or otherwise unsafe files that are then processed by the server. MITRE notes that such flaws can lead to arbitrary code execution and broader confidentiality, integrity, and availability impacts, especially when uploaded files are placed in web-accessible locations or extracted without proper validation. CERT Polska credited Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team with the responsible disclosure and said only version 2.2.4 was confirmed vulnerable, although other versions may also be affected.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CERT Polska published coordinated disclosures for 13 vulnerabilities affecting ATutor 2.2.4, tracked as CVE-2026-64960 through CVE-2026-64972. The issues included unrestricted file upload, authentication bypass, CSRF, path traversal, predictable tokens, missing authorization, SSRF, IDOR, and XSS, and CERT Polska said the flaws remain unfixed because ATutor is no longer actively supported.
MITRE published CWE-434, "Unrestricted Upload of File with Dangerous Type," defining the weakness as allowing dangerous uploaded files to be processed in a way that can enable code execution and other impacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecert.pl
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed four vulnerabilities in the Bludit content management system, including an unrestricted file upload flaw tracked as **CVE-2026-25099** that can lead to remote code execution, a stored XSS issue in image upload handling (**CVE-2026-25100**), a session fixation weakness that can enable session hijacking (**CVE-2026-25101**), and a separate stored XSS flaw in page creation tracked as **CVE-2026-4420**. The vulnerabilities were reported by researchers Arkadiusz Marta and Yassin Abdelrazek and affect multiple Bludit versions, with **CVE-2026-25099** impacting all releases before `3.18.4`, **CVE-2026-25101** affecting versions before `3.17.2`, **CVE-2026-25100** affecting all versions through `3.18.2`, and **CVE-2026-4420** confirmed in `3.17.2` and `3.18.0`. The XSS flaws can be exploited by authenticated users with content or page creation privileges by injecting malicious JavaScript into uploaded SVG content or article tags, with payloads executing when victims access publicly reachable resources without authentication. CERT Polska said the page-creation XSS could be used to automatically create a new site administrator if the victim has sufficient privileges, while the file upload issue could allow direct server-side compromise through remote code execution. The agency also said vendor coordination was incomplete, noting the vendor stopped responding or did not provide details on remediation and affected version ranges, raising uncertainty over whether some future releases may remain vulnerable.
Jun 29, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-78175** (CVSS 8.8), in the Tutor LMS WordPress plugin can let authenticated subscriber-level users execute code on affected servers. Versions 4.0.7 and earlier inadequately protect a withdrawal-account AJAX handler: it validates a nonce but does not enforce proper authorization, allowing crafted data to be stored in user records and later unsafely deserialized. Exploitation chains WordPress serialization-length desynchronization with a bundled Guzzle `FileCookieJar` deserialization gadget chain; sites with open student registration are particularly exposed because attackers can create the required account, provided monetization is enabled. Themeum addressed the issue in Tutor LMS **4.0.8** by restricting the handler to instructors, removing unsafe `esc_sql()` usage, validating withdrawal methods, and allowlisting form-field keys. Organizations using the plugin should update immediately and review user accounts, upload directories, administrator accounts, and web-server logs for suspicious activity. No active exploitation has been confirmed publicly.
Sep 18, 2026