CVE-2026-64963

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description A path traversal vulnerability allows an authenticated user to access files from other course directories. This occurs when the AT FORCE GET FILE configuration option is enabled, potentially leading to unauthorized file access and disclosure of the filesystem structure. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable the AT FORCE GET FILE configuration option to mitigate the risk of exploitation.