# ATutor LMS contains two reflected XSS vulnerabilities (CVE-2026-6909, CVE-2026-6956) in…

Published: 2026-05-11 · Severity: medium · Sectors: education
Canonical: https://vorant.io/reports/de6c3f70-7ec5-4d29-9efa-adb99b0d48e4/atutor-lms-contains-two-reflected-xss-vulnerabilities-cve-2026-6909-cve-2026

> ATutor LMS contains two reflected XSS vulnerabilities (CVE-2026-6909, CVE-2026-6956) in installation endpoints; product no longer actively supported.

CERT Polska coordinated disclosure of two reflected cross-site scripting vulnerabilities affecting ATutor, an open-source learning management system. CVE-2026-6909 exists in the /install/upgrade.php endpoint, while CVE-2026-6956 affects /install/install.php. Both allow attackers to execute arbitrary JavaScript in victims' browsers via specially crafted URLs. Version 2.2.4 was confirmed vulnerable during testing.

The vulnerabilities were responsibly reported by researchers from AFINE (Michał Majchrowicz, Marcin Wyczechowski, Pawel Zdunek). Project maintainers were notified but did not respond with vulnerability details or confirm the affected version range. Other versions beyond 2.2.4 remain untested but may also be vulnerable.

ATutor is no longer actively maintained, meaning these vulnerabilities are unlikely to receive official patches. Organizations still running ATutor should assess their exposure, particularly if installation endpoints remain accessible, and consider migration to supported alternatives.

## Mentioned in this report

- Vulnerabilities: CVE-2026-6909, CVE-2026-6956

## Detection guidance (public sample)

### Reflected XSS Attempt Against ATutor Install/Upgrade Endpoints

ATT&CK: T1189

Detects HTTP requests containing common XSS payload patterns (script tags, event handlers, javascript: URIs) in the query string targeting ATutor's /install/upgrade.php or /install/install.php endpoints, consistent with CVE-2026-6909/CVE-2026-6956 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reflected XSS Attempt Against ATutor Install/Upgrade Endpoints
id: b72b35bf-6111-5e0a-9916-f44560b6e343
status: experimental
description: 'Detects HTTP requests to ATutor''s /install/upgrade.php or /install/install.php

  containing typical reflected XSS payload markers in the URL/query string,

  matching the pattern of CVE-2026-6909 and CVE-2026-6956 exploitation attempts.

  '
references:
- CVE-2026-6909
- CVE-2026-6956
author: Vorant
logsource:
  category: proxy
  product: windows
detection:
  selection_path:
    c-uri|contains:
    - /install/upgrade.php
    - /install/install.php
  selection_payload:
    c-uri|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - '%3Cscript'
    - alert(
  condition: selection_path and selection_payload
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing ATutor install
  endpoints
- Security researchers validating the vulnerability on staging systems
level: high
tags:
- attack.t1189
- attack.t1059.007
```

### Suspicious Query String with Script Tags on Web Application Install Pages

ATT&CK: T1059.007

Generic detection for reflected XSS attempts on any web application install/upgrade scripts where JavaScript payloads are passed via URL parameters, relevant to unmaintained LMS platforms like ATutor lacking input sanitization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Script Payload in Query String on Install Pages
id: f9fa96c2-2317-5baf-93b7-82927441d5ad
status: experimental
description: 'Detects HTTP GET/POST requests to paths containing ''install'' or ''upgrade''
  scripts

  where the query string includes JavaScript execution markers, indicating a reflected

  XSS exploitation attempt similar to CVE-2026-6909/CVE-2026-6956 in ATutor LMS.

  '
references:
- CVE-2026-6909
- CVE-2026-6956
author: Vorant
logsource:
  category: webserver
  product: windows
detection:
  selection_path:
    cs-uri-stem|contains:
    - install
    - upgrade
  selection_ext:
    cs-uri-stem|endswith: .php
  selection_payload:
    cs-uri-query|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - document.cookie
  condition: selection_path and selection_ext and selection_payload
falsepositives:
- Legitimate QA/testing of install scripts using automated fuzzing tools
- Web application firewalls or scanners replaying XSS test payloads for compliance
  checks
level: medium
tags:
- attack.t1059.007
- attack.t1189
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6909

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/de6c3f70-7ec5-4d29-9efa-adb99b0d48e4/atutor-lms-contains-two-reflected-xss-vulnerabilities-cve-2026-6909-cve-2026.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup