An authenticated arbitrary file upload vulnerability exists in the Courses/Work Assignments module of gunet Open eClass version 3.11. The flaw allows an attacker with valid login credentials to upload a specially crafted SVG file; when processed, the SVG can trigger arbitrary code execution on the server. This attack vector results in the loss of confidentiality, integrity, and potentially availability, as the attacker can execute malicious commands on the application’s host. The weakness is classified as CWE‑79, indicating improper validation of user‑supplied input.

The vulnerability affects the gunet Open eClass product, specifically version 3.11. The fix was introduced in version 3.13. No other vendors or products are listed as affected.

The CVSS score of 5.4 places the vulnerability in the moderate severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Because the exploit requires authenticated access and the upload of a malicious SVG, it is feasible for an attacker possessing legitimate credentials to carry it out. Given the potential for remote code execution, the risk is significant for organizations running vulnerable versions.