ATutor Gameme module permits arbitrary file uploads without file type validation and stores them in a web‑accessible directory before content is checked. An attacker who is authenticated and knows a valid course identifier can upload a server‑executable script. When that file is requested over HTTP, the web server runs it as the web process, giving the attacker remote code execution. The vulnerability is a classic uncontrolled file upload weakness, specifically CWE‑434. The impact is loss of confidentiality, integrity, and availability for the entire server, as the attacker can execute any code system‑wide.

The vulnerability has been confirmed in ATutor version 2.2.4. Other versions of ATutor were not explicitly tested but may also be affected. The flaw is present in the Gameme module and can be exploited when course_id=0, which often represents the global context.

The CVSS score of 8.7 indicates high severity. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated within ATutor and to know a valid course_id; the attacker must then upload a malicious file and trigger HTTP access to that file. Once executed, the web server process has the same privileges as the application, providing full remote code execution. Given the lack of active support and the absence of a patch, the risk remains high for any system that still runs ATutor 2.2.4 or unsupported versions.