ATutor contains a path traversal flaw in its ZIP extraction routine. An attacker with instructor‑level privileges can upload a specially crafted ZIP archive and extract it to an arbitrary location, causing files to be written outside the intended extraction directory. This flaw permits the placement of a server‑executable .phtml file in the web root, enabling the attacker to execute arbitrary code with the web server’s privileges. The CVSS score of 8.7 indicates a high‑severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog; however, the product is no longer actively supported, so the flaw remains unpatched.

ATutor installations, primarily version 2.2.4 confirmed vulnerable; other released versions were not tested but may also be affected because the underlying code path has not changed.

The vulnerability is exploitable via the web application’s instructor interface, requiring authenticated instructor access and the ability to upload files. The path traversal flaw allows the attacker to redirect extraction into any writable location, typically the web root, where a malicious .phtml file can be executed. Because the community has discontinued support and no official fix exists, the risk of exploitation remains high for any running instance that still permits instructor uploads. With no EPSS data, public exploitation is uncertain, but the high CVSS score and absence of a patch suggest a significant risk window. Mitigation is therefore urgent for any deployed ATutor.