CVE-2026-64963

LowCVSS 2.3/10Last modified Aug 28, 2026

Description

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.

Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Metrics

CVSS 4.0 2.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-649646.3ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functional CVE-2026-649655.3ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a stud CVE-2026-649668.7ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload an CVE-2026-649676.9A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outs CVE-2026-649685.1ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request ar CVE-2026-649695.3ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, includi CVE-2026-64976.3A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the f CVE-2026-649705.1ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaS CVE-2026-649714.8ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results i CVE-2026-649724.8ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup CVE-2026-64985.3The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and in CVE-2026-64992.4Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue af