ATutor LMS reflected XSS vulnerabilities in installation endpoints
ATutor LMS contains two reflected XSS vulnerabilities (CVE-2026-6909, CVE-2026-6956) in installation endpoints; product no longer actively supported.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two reflected cross-site scripting vulnerabilities affecting ATutor, an open-source learning management system. CVE-2026-6909 exists in the /install/upgrade.php endpoint, while CVE-2026-6956 affects /install/install.php. Both allow attackers to execute arbitrary JavaScript in victims' browsers via specially crafted URLs. Version 2.2.4 was confirmed vulnerable during testing.
The vulnerabilities were responsibly reported by researchers from AFINE (Michał Majchrowicz, Marcin Wyczechowski, Pawel Zdunek). Project maintainers were notified but did not respond with vulnerability details or confirm the affected version range. Other versions beyond 2.2.4 remain untested but may also be vulnerable.
ATutor is no longer actively maintained, meaning these vulnerabilities are unlikely to receive official patches. Organizations still running ATutor should assess their exposure, particularly if installation endpoints remain accessible, and consider migration to supported alternatives.
Mentioned in this report
Detection guidance
Reflected XSS Attempt Against ATutor Install/Upgrade Endpoints
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests containing common XSS payload patterns (script tags, event handlers, javascript: URIs) in the query string targeting ATutor's /install/upgrade.php or /install/install.php endpoints, consistent with CVE-2026-6909/CVE-2026-6956 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reflected XSS Attempt Against ATutor Install/Upgrade Endpoints
id: b72b35bf-6111-5e0a-9916-f44560b6e343
status: experimental
description: 'Detects HTTP requests to ATutor''s /install/upgrade.php or /install/install.php
containing typical reflected XSS payload markers in the URL/query string,
matching the pattern of CVE-2026-6909 and CVE-2026-6956 exploitation attempts.
'
references:
- CVE-2026-6909
- CVE-2026-6956
author: Vorant
logsource:
category: proxy
detection:
selection_path:
c-uri|contains:
- /install/upgrade.php
- /install/install.php
selection_payload:
c-uri|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- '%3Cscript'
- alert(
condition: selection_path and selection_payload
falsepositives:
- Automated vulnerability scanners or penetration testing tools probing ATutor install
endpoints
- Security researchers validating the vulnerability on staging systems
level: high
tags:
- attack.t1189
- attack.t1059.007
Suspicious Query String with Script Tags on Web Application Install Pages
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Generic detection for reflected XSS attempts on any web application install/upgrade scripts where JavaScript payloads are passed via URL parameters, relevant to unmaintained LMS platforms like ATutor lacking input sanitization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Script Payload in Query String on Install Pages
id: f9fa96c2-2317-5baf-93b7-82927441d5ad
status: experimental
description: 'Detects HTTP GET/POST requests to paths containing ''install'' or ''upgrade''
scripts
where the query string includes JavaScript execution markers, indicating a reflected
XSS exploitation attempt similar to CVE-2026-6909/CVE-2026-6956 in ATutor LMS.
'
references:
- CVE-2026-6909
- CVE-2026-6956
author: Vorant
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains:
- install
- upgrade
selection_ext:
cs-uri-stem|endswith: .php
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- document.cookie
condition: selection_path and selection_ext and selection_payload
falsepositives:
- Legitimate QA/testing of install scripts using automated fuzzing tools
- Web application firewalls or scanners replaying XSS test payloads for compliance
checks
level: medium
tags:
- attack.t1059.007
- attack.t1189
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-6909
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs