CVE-2026-64968 Server-Side Request Forgery in ATutor
An authenticated administrator can exploit Server-Side Request Forgery in ATutor to access internal services or local files, requiring migration due to lack of support.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64968?
CVE-2026-64968 is a medium-severity server-side request forgery vulnerability in ATutor, published on 20 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers.
Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Weakness: CWE-918
Which versions are affected by CVE-2026-64968?
How do I fix CVE-2026-64968?
No fix has been published for CVE-2026-64968 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-64968 being exploited?
There is no known exploitation of CVE-2026-64968 in the wild and no public exploit code.
Sources
Also known as GHSA-3g5v-7qvh-xxq4.