HighPublic exploit

Arbitrary File Upload RCE in Open eClass Theme Import

IdentifiersCVE-2026-22241CWE-434· Unrestricted Upload of File with…

CVE-2026-22241 affects the Open eClass platform (formerly GUnet eClass) prior to version 4.2. The vulnerability is in the theme import functionality, where ZIP archives are processed without proper validation or sanitization of the files contained within the archive. An attacker with administrative privileges can upload a crafted archive containing arbitrary files and cause those files to be written to the server file system. Because this can include executable server-side code placed in a web-accessible location, successful exploitation can result in remote code execution on the web server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated administrator to write arbitrary files to the server file system via the theme import mechanism. In practical terms, this can be used to upload a web shell or other executable payload and achieve remote code execution in the context of the web server process. Depending on deployment specifics, this may enable full application compromise, access to sensitive course and user data, modification of platform content, persistence, and potential lateral movement from the affected host.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, restrict access to the theme import functionality to the smallest possible set of trusted administrators, and disable the feature entirely if operationally feasible. Monitor for suspicious ZIP imports and unexpected file creation in theme directories and other web-accessible paths. Harden the web server so uploaded content cannot be executed where possible, and review administrative accounts for compromise or misuse. These measures reduce exposure but do not fully remediate the underlying flaw.

Remediation

Patch, then assume compromise.

Upgrade Open eClass to version 4.2 or later, which patches the vulnerable theme import behavior. Ensure that theme import handling enforces strict validation of archive contents, including allowed file types, destination paths, and rejection of executable or unexpected files. Review the server for unauthorized uploaded files, especially within theme and web-accessible directories, and remove any malicious artifacts if compromise is suspected.

PUBLIC EXPLOITS

Exploits

2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).

VALID 2 / 4 TOTALView more in app

CVE-2026-22241MaturityPoCVerified exploit

Repository is a small lab + PoC for CVE-2026-22241 described as an unrestricted file upload leading to RCE in Open eClass/OpenClass Educational Infrastructure. Structure/purpose: - README.md: Step-by-step instructions to build a Dockerized Open eClass 4.0.1 environment, then exploit an admin-only theme upload feature by uploading a ZIP (poc.zip) containing a PHP webshell. Provides example URLs to trigger command execution. - docker-compose.yml: Defines a two-container lab (mysql:8.0 and php:8.3-apache) with the application mounted into /var/www/html and exposed on host port 8080. - evil.php: The actual payload (minimal PHP webshell) executing shell commands from the 'cmd' query parameter. Exploit capability: - Achieves remote command execution over HTTP after successful upload by requesting /courses/theme_data/evil.php?cmd=<command>. - No automated exploitation code is included; exploitation is manual via the web UI upload flow. The included payload is a basic webshell (no persistence, no reverse shell, no obfuscation).

CVEs-LabsDisclosed Feb 18, 2026yamlphpnetwork

CVE-2026-22241MaturityOperationalVerified exploit

Repository contains a single Python exploit script (CVE-2026-22241.py), a README, requirements.txt, and GPLv3 LICENSE. The exploit targets Open eClass versions prior to 4.2 (CVE-2026-22241), abusing an unrestricted file upload in the admin Theme Import feature. Core flow: 1) Authenticates to the target using provided admin credentials by POSTing to /?login_page=1 (with Referer /main/login_form.php?next=%2Fmain%2Fportfolio.php). 2) Creates a local ZIP (poc.zip) containing a PHP webshell (evil.php) that executes system($_REQUEST['cmd']). 3) Fetches /modules/admin/theme_options.php to confirm admin access and scrape a CSRF token from an input named token. 4) Uploads the ZIP to /modules/admin/theme_options.php as themeFile, leveraging the vulnerable import mechanism to place the PHP file under /courses/theme_data/. 5) Provides an interactive pseudo-shell that sends commands to /courses/theme_data/evil.php?cmd=<cmd> and prints output. 6) On 'quit', attempts cleanup by invoking rm evil.php through the webshell. The repository is an operational RCE exploit (not just detection): it includes a working payload, automated token handling, upload logic, and an interactive command loop. No external C2 infrastructure is embedded; all network interaction is with the user-supplied target base URL.

AshifcoderDisclosed Jan 12, 2026pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

OpeneclassOpeneclassapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3