A path traversal flaw in ATutor's error log viewer lets an attacker who has administrative credentials read any file accessible to the web server process. The weakness falls under CWE-22 and can expose confidential data, configuration files, or other sensitive resources. The vulnerability does not provide a direct code‑execution path, but it grants extensive read access to the system.

The flaw is confirmed in ATutor version 2.2.4, which is no longer under active support. Other older versions were not tested but may also be vulnerable. The product vendor is ATutor, and administrators of the ATutor platform can be impacted by this flaw.

The CVSS score of 6.9 reflects a moderate severity. Because the attack requires administrative access to the ATutor application, exploitation is limited to users who can authenticate as a system administrator. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the lack of a vendor patch and the critical nature of the accessed files keep the operational risk high for installations still running the affected version.