CERT Polska discloses 13 unpatched ATutor flaws
CERT Polska coordinated disclosure of 13 vulnerabilities in the unsupported ATutor LMS, including unauthenticated auth bypass and multiple RCE paths, with no fixes available.
Sourcecert.pl — open the original
What to check
- Applies to
- The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska, working with researchers Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, coordinated disclosure of 13 vulnerabilities affecting ATutor, an open-source e-learning/course management system. The most severe issues include an unrestricted file upload flaw in the Gameme module (CVE-2026-64960) that allows an authenticated user to achieve remote code execution as the web server user, and an authentication bypass (CVE-2026-64961) stemming from uninitialized token validation in the auto-login feature, letting an unauthenticated attacker forge valid tokens and impersonate any user, including administrators, without a password. A second RCE path (CVE-2026-64966) allows an instructor-privileged attacker to abuse ZIP extraction path traversal to drop a web-executable .phtml file into the webroot.
The remaining issues are a mix of medium-severity flaws: CSRF on profile updates, path traversal in course file access and log viewing, predictable email confirmation tokens enabling account takeover, missing authorization checks on test/question import endpoints, SSRF in import functionality (including potential cloud metadata access), an IDOR allowing deletion of other users' profile pictures, stored XSS via the registration phone field, and reflected XSS in restore and preview functionality. Only ATutor 2.2.4 was tested and confirmed vulnerable, though other versions may share the flaws.
Critically, ATutor is no longer actively maintained and none of the 13 vulnerabilities have been patched. Organizations still running ATutor instances — commonly used in academic and training environments — face compounding risk since the auth bypass and file-upload RCE can be chained by a low-privileged or even unauthenticated attacker to fully compromise a server. Given the lack of vendor remediation, affected deployments should be isolated, decommissioned, or replaced.
Mentioned in this report
Detection guidance
Web Server Process Spawning Command Shell (Possible Webshell RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP-FPM/IIS worker process spawning a system shell or scripting interpreter, consistent with execution of a webshell dropped via an unrestricted file-upload or ZIP path-traversal vulnerability (e.g. ATutor Gameme module RCE, phtml drop via ZIP extraction). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell (Possible Webshell RCE)
description: Detects web server / PHP worker processes (apache, httpd, nginx, php-fpm,
w3wp.exe) spawning a command shell or scripting interpreter. This is the typical
post-exploitation behaviour after an attacker uploads a web-executable file (e.g.
.php/.phtml) through an unrestricted file upload or ZIP-extraction path traversal
flaw such as those disclosed in ATutor, and then triggers execution of that file
to gain remote code execution as the web server user.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /php-fpm
- /nginx
- /fpm-php
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
- /bin/ksh
filter_known_helpers:
CommandLine|contains:
- logrotate
- certbot
- /usr/sbin/service
condition: selection and not filter_known_helpers
falsepositives:
- Legitimate web applications that shell out to system utilities (image processing,
mail sending, cron helper scripts)
- Server management scripts triggered via cron through the web server user
level: high
id: d629b84c-f463-50cb-a7fa-6493df68e191
status: experimental
author: Vorant
Web-Executable Script File Written to Upload or Content Directory by Web Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a PHP/PHTML-family script file inside an upload or content directory by the web server process user, matching the unrestricted-upload RCE and ZIP-extraction path-traversal RCE patterns disclosed for ATutor (Gameme module upload, .phtml drop via archive extraction). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web-Executable Script File Written to Upload or Content Directory by Web Server
Process
description: Detects the web server process writing a new file with a web-executable
script extension (.php, .phtml, .pht, .php3-5, .phar) into an uploads/content directory.
This generalises the ATutor Gameme-module unrestricted file upload RCE and the ZIP-extraction
path traversal that drops a .phtml file into the webroot, without matching the campaign-specific
filename.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
Image|endswith:
- /apache2
- /httpd
- /php-fpm
- /nginx
TargetFilename|endswith:
- .php
- .phtml
- .pht
- .php3
- .php4
- .php5
- .phar
TargetFilename|contains:
- /uploads/
- /content/
- /upload/
- /gameme/
filter_deployment:
TargetFilename|contains:
- /vendor/
- /composer/
condition: selection and not filter_deployment
falsepositives:
- Legitimate administrator deployment of new PHP application code into the same directory
tree via package manager
- CMS/plugin auto-update mechanisms writing PHP files to content directories
level: high
id: daf141e9-3f5f-5511-af68-2768bb248599
status: experimental
author: Vorant
HTTP Request with Login Token Parameter to Auto-Login Endpoint Without Session Cookie
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to login/auto-login functionality carrying a token-style parameter but lacking a prior authenticated session cookie, consistent with forging an auto-login token to bypass authentication (as in the ATutor uninitialized-token auth bypass) and impersonate arbitrary users including administrators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request with Login Token Parameter to Auto-Login Endpoint Without Session
Cookie
description: Detects requests to login or auto-login web endpoints that include a
token-style query/body parameter but do not present an existing authenticated session
cookie. This matches the behavioural pattern of exploiting an uninitialized/predictable
auto-login token to impersonate a user without valid credentials, such as the ATutor
auth-bypass flaw.
tags:
- attack.initial-access
- attack.stealth
- attack.t1078
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- auto_login
- autologin
- /login
cs-uri-query|contains:
- token=
- auto_login=
filter_authenticated:
cs-cookie|contains:
- PHPSESSID=
- session=
condition: selection and not filter_authenticated
falsepositives:
- Legitimate password-reset or email-confirmation links that legitimately carry one-time
tokens to unauthenticated users
- SSO/federation auto-login integrations that pass signed tokens as part of normal
login flow
level: medium
id: 896b845b-4fb3-5a3c-8b63-777799a8971a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-64960
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs