ATutor’s import functionality permits an authenticated administrator to instruct the server to perform arbitrary requests to internal HTTP endpoints, cloud metadata services, or locally‑stored files via the file:// protocol when PHP URL wrappers are enabled. This flaw can expose sensitive internal information or serve as a vector for additional exploitation, as the server makes the request without validating the target address. The weakness is classified as CWE‑918, where unchecked data leads to request forgery.

ATutor version 2.2.4 is confirmed vulnerable; other releases have not been tested and may also be susceptible. The product is no longer actively maintained, and no patch exists to fix the issue.

The CVSS score of 5.1 places the vulnerability in the moderate category. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog. Because the attack requires administrator authentication and the ability to trigger import functions, the likelihood of exploitation is limited to privileged users or compromised admin accounts. Nonetheless, once accessed, the server can reach internal resources that should not be exposed externally.