CVE-2026-64960

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description The Gameme module allows authenticated users to upload files of any type and extension without restriction. Because files are stored in a web-accessible location before content validation, an attacker with a valid course id (often course id=0 for global context) can upload a server-executable malicious script. Requesting this file over HTTP leads to remote code execution with the privileges of the web server process user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.