CVE-2026-64967
Received Received - Intake

Path Traversal in ATutor Error Log Viewer

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT.PL

Description
A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64967
EUVD
EUVD-2026-63368

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
atutor atutor to 2.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in ATutor's error log viewer. It allows an attacker with admin privileges to access files outside the intended logs directory. This could expose sensitive files or resources accessible to the web server.

Detection Guidance

Since ATutor is no longer supported and the vulnerability involves path traversal in the error log viewer, manual inspection of file access patterns is needed. Check web server logs for unusual file access requests outside the logs directory. Look for administrative actions that may indicate exploitation attempts.

Impact Analysis

An attacker could read sensitive files on the server, potentially gaining access to credentials, configuration files, or other confidential data. This could lead to further compromise of the system or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR or HIPAA requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict administrative access to ATutor. Disable or remove ATutor 2.2.4 if possible. Monitor file access logs for suspicious activity. Consider migrating to a supported alternative as the product is no longer maintained.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64967. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart