# CERT Polska discloses 13 unpatched ATutor flaws

Published: 2026-08-20 · Severity: routine · Sectors: education
Canonical: https://vorant.io/reports/8a84ffcc-48b8-5081-9fad-d63d9b2f3a3b/cert-polska-discloses-13-unpatched-atutor-flaws

> CERT Polska coordinated disclosure of 13 vulnerabilities in the unsupported ATutor LMS, including unauthenticated auth bypass and multiple RCE paths, with no fixes available.

CERT Polska, working with researchers Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, coordinated disclosure of 13 vulnerabilities affecting ATutor, an open-source e-learning/course management system. The most severe issues include an unrestricted file upload flaw in the Gameme module (CVE-2026-64960) that allows an authenticated user to achieve remote code execution as the web server user, and an authentication bypass (CVE-2026-64961) stemming from uninitialized token validation in the auto-login feature, letting an unauthenticated attacker forge valid tokens and impersonate any user, including administrators, without a password. A second RCE path (CVE-2026-64966) allows an instructor-privileged attacker to abuse ZIP extraction path traversal to drop a web-executable .phtml file into the webroot.

The remaining issues are a mix of medium-severity flaws: CSRF on profile updates, path traversal in course file access and log viewing, predictable email confirmation tokens enabling account takeover, missing authorization checks on test/question import endpoints, SSRF in import functionality (including potential cloud metadata access), an IDOR allowing deletion of other users' profile pictures, stored XSS via the registration phone field, and reflected XSS in restore and preview functionality. Only ATutor 2.2.4 was tested and confirmed vulnerable, though other versions may share the flaws.

Critically, ATutor is no longer actively maintained and none of the 13 vulnerabilities have been patched. Organizations still running ATutor instances — commonly used in academic and training environments — face compounding risk since the auth bypass and file-upload RCE can be chained by a low-privileged or even unauthenticated attacker to fully compromise a server. Given the lack of vendor remediation, affected deployments should be isolated, decommissioned, or replaced.

## Mentioned in this report

- Vulnerabilities: CVE-2026-64960, CVE-2026-64961, CVE-2026-64962, CVE-2026-64963, CVE-2026-64964, CVE-2026-64965, CVE-2026-64966, CVE-2026-64967, CVE-2026-64968, CVE-2026-64969, CVE-2026-64970, CVE-2026-64971, CVE-2026-64972

## Detection guidance (public sample)

### Web Server Process Spawning Command Shell (Possible Webshell RCE)

ATT&CK: T1190

Detects a web server or PHP-FPM/IIS worker process spawning a system shell or scripting interpreter, consistent with execution of a webshell dropped via an unrestricted file-upload or ZIP path-traversal vulnerability (e.g. ATutor Gameme module RCE, phtml drop via ZIP extraction). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Command Shell (Possible Webshell RCE)
description: Detects web server / PHP worker processes (apache, httpd, nginx, php-fpm,
  w3wp.exe) spawning a command shell or scripting interpreter. This is the typical
  post-exploitation behaviour after an attacker uploads a web-executable file (e.g.
  .php/.phtml) through an unrestricted file upload or ZIP-extraction path traversal
  flaw such as those disclosed in ATutor, and then triggers execution of that file
  to gain remote code execution as the web server user.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /php-fpm
    - /nginx
    - /fpm-php
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    - /bin/ksh
  filter_known_helpers:
    CommandLine|contains:
    - logrotate
    - certbot
    - /usr/sbin/service
  condition: selection and not filter_known_helpers
falsepositives:
- Legitimate web applications that shell out to system utilities (image processing,
  mail sending, cron helper scripts)
- Server management scripts triggered via cron through the web server user
level: high
id: d629b84c-f463-50cb-a7fa-6493df68e191
status: experimental
author: Vorant
```

### Web-Executable Script File Written to Upload or Content Directory by Web Server Process

ATT&CK: T1190

Detects creation of a PHP/PHTML-family script file inside an upload or content directory by the web server process user, matching the unrestricted-upload RCE and ZIP-extraction path-traversal RCE patterns disclosed for ATutor (Gameme module upload, .phtml drop via archive extraction). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web-Executable Script File Written to Upload or Content Directory by Web Server
  Process
description: Detects the web server process writing a new file with a web-executable
  script extension (.php, .phtml, .pht, .php3-5, .phar) into an uploads/content directory.
  This generalises the ATutor Gameme-module unrestricted file upload RCE and the ZIP-extraction
  path traversal that drops a .phtml file into the webroot, without matching the campaign-specific
  filename.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /apache2
    - /httpd
    - /php-fpm
    - /nginx
    TargetFilename|endswith:
    - .php
    - .phtml
    - .pht
    - .php3
    - .php4
    - .php5
    - .phar
    TargetFilename|contains:
    - /uploads/
    - /content/
    - /upload/
    - /gameme/
  filter_deployment:
    TargetFilename|contains:
    - /vendor/
    - /composer/
  condition: selection and not filter_deployment
falsepositives:
- Legitimate administrator deployment of new PHP application code into the same directory
  tree via package manager
- CMS/plugin auto-update mechanisms writing PHP files to content directories
level: high
id: daf141e9-3f5f-5511-af68-2768bb248599
status: experimental
author: Vorant
```

### HTTP Request with Login Token Parameter to Auto-Login Endpoint Without Session Cookie

ATT&CK: T1078

Detects HTTP requests to login/auto-login functionality carrying a token-style parameter but lacking a prior authenticated session cookie, consistent with forging an auto-login token to bypass authentication (as in the ATutor uninitialized-token auth bypass) and impersonate arbitrary users including administrators. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP Request with Login Token Parameter to Auto-Login Endpoint Without Session
  Cookie
description: Detects requests to login or auto-login web endpoints that include a
  token-style query/body parameter but do not present an existing authenticated session
  cookie. This matches the behavioural pattern of exploiting an uninitialized/predictable
  auto-login token to impersonate a user without valid credentials, such as the ATutor
  auth-bypass flaw.
tags:
- attack.initial-access
- attack.defense-evasion
- attack.t1078
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - auto_login
    - autologin
    - /login
    cs-uri-query|contains:
    - token=
    - auto_login=
  filter_authenticated:
    cs-cookie|contains:
    - PHPSESSID=
    - session=
  condition: selection and not filter_authenticated
falsepositives:
- Legitimate password-reset or email-confirmation links that legitimately carry one-time
  tokens to unauthenticated users
- SSO/federation auto-login integrations that pass signed tokens as part of normal
  login flow
level: medium
id: 896b845b-4fb3-5a3c-8b63-777799a8971a
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-64960

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8a84ffcc-48b8-5081-9fad-d63d9b2f3a3b/cert-polska-discloses-13-unpatched-atutor-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup