An attacker who can work out a user's identifier and the moment that user registered can log into ATutor as that person, administrators included, without ever knowing the password. That is one of thirteen vulnerabilities Poland's national CERT published on August 20, and none of them are going to be fixed. ATutor, an open source learning management system used to run online courses, is no longer actively supported.
The flaws, CVE-2026-64960 through CVE-2026-64972, were found by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team, who reported them through CERT Polska's coordinated disclosure process. Only version 2.2.4 was tested and confirmed vulnerable. CERT Polska notes that other versions were not tested and might also be affected. The advisory carries no CVSS scores, so there is no published severity rating to rank these by.
Two separate routes to running code on the server
The first is a file upload in the Gameme module that accepts any file type and stores what it receives somewhere the web server will serve, before anything checks the contents. An authenticated user who knows a valid course_id, and CERT Polska points out that 0 usually works because it represents the global context, can upload a server-executable script and then simply request it over HTTP, running code as the web server user. That is CVE-2026-64960.
The second needs instructor privileges. A specially crafted ZIP archive escapes the directory it is supposed to unpack into and writes a server-executable .phtml file into the web root, with the same outcome. That is CVE-2026-64966.
The login bypass needs no account at all
CVE-2026-64961 is the one that requires nothing to start with. ATutor's auto-login path does check a token, but on certain code paths the values that check depends on are never initialized, so an unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a token that validates and sign in as that user, up to and including an administrator.
And ten more, mostly reachable by a student
The rest of the list covers a cross-site request forgery in profile updates that lets an attacker modify another user's fields (CVE-2026-64962), two path traversals that reach files outside their intended directories (CVE-2026-64963 and CVE-2026-64967), predictable account confirmation tokens that let somebody activate an account without access to the victim's inbox (CVE-2026-64964), a missing authorization check that lets a low-privileged student import tests and questions (CVE-2026-64965), a server-side request forgery in the import functions that can reach internal endpoints, cloud metadata services or local files (CVE-2026-64968), an insecure direct object reference that lets any logged-in user permanently delete another user's profile picture, instructors and administrators included (CVE-2026-64969), and three cross-site scripting issues, one of them stored in the registration form's phone field and fired whenever an authenticated user views the attacker's public profile (CVE-2026-64970, CVE-2026-64971 and CVE-2026-64972).
No patch is coming, so plan the move
There is no update to apply, which changes what remediation means here. An unsupported application carrying an unauthenticated administrator login and two paths to code execution should not be reachable from the internet at all, and the only durable fix is to move the courses onto something that is still maintained. Short of that, pull the instance off public networks, close self-registration, and treat any host that has been exposed as a candidate for review rather than assuming it is clean. It is the bind defenders were left in when F5 disclosed a BIG-IP DNS flaw with workarounds and no fix, except that here nobody is coming back with a patch later. Education platforms are worth the attacker's time: ShinyHunters broke into universities through an Oracle PeopleSoft zero day earlier this year.
The full advisory, with the description of each issue, is on CERT Polska's site.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.