CVE-2026-24665 Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload
Authenticated students can inject malicious JavaScript via assignment uploads, leading to code execution when instructors view submissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-24665?
CVE-2026-24665 is a high-severity cross-site scripting vulnerability in gunet openeclass, published on 3 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors view the submission. This issue has been patched in version 4.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-24665?
It affects 1 product.
Products include Gunet Open Eclass Platform.
How do I fix CVE-2026-24665?
No fix has been published for CVE-2026-24665 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-24665 being exploited?
There is no known exploitation of CVE-2026-24665 in the wild and no public exploit code.
Other vulnerabilities in gunet openeclass
- CVE-2020-37113 GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass
- CVE-2020-37116 GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access
- CVE-2026-24669 Open eClass Insecure Password Reset Token Reuse Enables Account Takeover
- CVE-2026-24773 Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files
- CVE-2020-24381 Information disclosure in n/a
Sources
Also known as GHSA-2qgm-m7fm-m888.