CVE-2026-64967 - Path Traversal in ATutor

Back Back to CVE browser

MEDIUM

Path Traversal in ATutor

Published Aug 20, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.49%

Description

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process.

Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Affected products

Vendor ATutor Product ATutor Default
n/a
- Version
  2.2.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ATutor

n/a

Version	Status	Constraints
2.2.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://atutor.github.io/
product
https://cert.pl/en/posts/2026/08/CVE-2026-64960
third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63368
Advisory

Link	Providers	Tags
https://atutor.github.io/		product
https://cert.pl/en/posts/2026/08/CVE-2026-64960		third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63368		Advisory