CVE-2026-64963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64963", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-07-21T09:36:01.217Z", "datePublished": "2026-08-20T13:57:53.726Z", "dateUpdated": "2026-08-20T15:26:25.720Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-20T13:57:53.726Z"}, "title": "Path Traversal in ATutor", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "ATutor", "product": "ATutor", "repo": "https://github.com/atutor/ATutor", "versions": [{"status": "affected", "version": "2.2.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the\u00a0AT_FORCE_GET_FILE\u00a0configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.\n\n\n\n\n\n\n\n\nProduct is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div></div><div><i></i><div><div><span>A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the&nbsp;</span>AT_FORCE_GET_FILE&nbsp;<span>configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.</span></div></div></div><div><br></div><div>Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.</div>"}]}], "tags": ["x_open-source", "unsupported-when-assigned"], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-64960", "tags": ["third-party-advisory"]}, {"url": "https://atutor.github.io/", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Micha\u0142 Majchrowicz (AFINE Team)", "type": "finder"}, {"lang": "en", "value": "Marcin Wyczechowski (AFINE Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T14:58:22.469234Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:26:25.720Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T14:58:22.469234Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T15:20:45.548Z"}}], "cna": {"tags": ["x_open-source", "unsupported-when-assigned"], "title": "Path Traversal in ATutor", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Micha\u0142 Majchrowicz (AFINE Team)"}, {"lang": "en", "type": "finder", "value": "Marcin Wyczechowski (AFINE Team)"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/atutor/ATutor", "vendor": "ATutor", "product": "ATutor", "versions": [{"status": "affected", "version": "2.2.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/en/posts/2026/08/CVE-2026-64960", "tags": ["third-party-advisory"]}, {"url": "https://atutor.github.io/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the\u00a0AT_FORCE_GET_FILE\u00a0configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.\n\n\n\n\n\n\n\n\nProduct is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.", "supportingMedia": [{"type": "text/html", "value": "<div></div><div><i></i><div><div><span>A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the&nbsp;</span>AT_FORCE_GET_FILE&nbsp;<span>configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.</span></div></div></div><div><br></div><div>Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.</div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-08-20T13:57:53.726Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64963", "state": "PUBLISHED", "dateUpdated": "2026-08-20T15:26:25.720Z", "dateReserved": "2026-07-21T09:36:01.217Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-08-20T13:57:53.726Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "ATutor", "repo": "https://github.com/atutor/ATutor", "vendor": "ATutor", "versions": [{"status": "affected", "version": "2.2.4", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [{"sourceIdentifier": "cvd@cert.pl", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the\u00a0AT_FORCE_GET_FILE\u00a0configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure.\n\n\n\n\n\n\n\n\nProduct is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en ATutor permite a un usuario autenticado acceder a archivos de otros directorios de cursos cuando la opci\u00f3n de configuraci\u00f3n AT_FORCE_GET_FILE est\u00e1 habilitada. Esto puede llevar a acceso no autorizado a archivos y a la divulgaci\u00f3n de informaci\u00f3n sobre la estructura del sistema de archivos.\n\nEl producto ya no recibe soporte activo y las vulnerabilidades no han sido corregidas. Solo la versi\u00f3n 2.2.4 fue probada y confirmada como vulnerable, otras versiones no fueron probadas pero tambi\u00e9n podr\u00edan ser vulnerables."}], "id": "CVE-2026-64963", "lastModified": "2026-10-27T10:10:00.240", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64963", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T14:58:22.469234Z", "version": "2.0.3"}}]}, "published": "2026-08-20T14:17:44.850", "references": [{"source": "cvd@cert.pl", "url": "https://atutor.github.io/"}, {"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/08/CVE-2026-64960"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ATutor", "source": "cna", "vendor": "ATutor"}, "product": "atutor", "vendor": "atutor"}], "created": "2026-08-20T15:45:03.232784+00:00", "updated": "2026-08-20T21:00:05.533684+00:00", "vendors": ["atutor", "atutor$PRODUCT$atutor"]}