CVE-2026-64968

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description An authenticated administrator can perform Server-Side Request Forgery (SSRF) through import functionalities. This allows the server to make requests to arbitrary internal HTTP endpoints, cloud metadata services, or local files using the file:// wrapper, provided the PHP environment permits URL wrappers. SSRF is a flaw where an attacker induces a server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.