CVE-2019-12169

HIGH

ATutor 2.2.1-2.2.4 - Path Traversal and Arbitrary File Upload via Language Import ZIP Archive

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2019-12169. PoCs published by fuzzlove, fuzzlove-group, liquidsky (JMcPeters), Erik Wynter, including Metasploit module exploits/multi/http/atutor_upload_traversal.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-12169, which leverages arbitrary file upload and directory traversal in ATutor 2.2.4 to achieve remote code execution. The exploit crafts a malicious ZIP archive with traversal paths to drop a PHP shell in the web root.

Description

ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.

Exploits (3)

nomisec WORKING POC 3 stars
by fuzzlove · poc
https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit

This repository contains a functional exploit for CVE-2019-12169, which leverages arbitrary file upload and directory traversal in ATutor 2.2.4 to achieve remote code execution. The exploit crafts a malicious ZIP archive with traversal paths to drop a PHP shell in the web root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ATutor 2.2.4
Auth required
Prerequisites: Valid credentials for ATutor · Access to the language import or patcher functionality
devstral-2 · analyzed Feb 18, 2026 Full analysis →
gitlab WORKING POC
by fuzzlove-group · poc
https://gitlab.com/fuzzlove-group/ATutor-2-2-4-Language-Exploit

This repository contains a functional Python exploit for CVE-2019-12169, which leverages arbitrary file upload and directory traversal in ATutor 2.2.4 to achieve remote code execution. The exploit crafts a malicious ZIP archive with traversal paths to drop a PHP shell in the web root.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ATutor 2.2.4
Auth required
Prerequisites: valid credentials for ATutor · access to the language import or patcher functionality
devstral-2 · analyzed Feb 23, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by liquidsky (JMcPeters), Erik Wynter · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/atutor_upload_traversal.rb

This Metasploit module exploits a directory traversal and arbitrary file upload vulnerability in ATutor to achieve remote code execution. It leverages admin credentials to upload a malicious PHP file via 'Import New Language' or 'Patcher' functions, then executes it via HTTP GET request.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ATutor 2.2.4, 2.2.2, 2.2.1
Auth required
Prerequisites: Valid admin credentials for ATutor · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory x_refsource_misc
https://github.com/fuzzlove
Exploit, Third Party Advisory x_refsource_misc
https://github.com/fuzzlove/ATutor-2.2.4-Language-Exploit
Exploit, Third Party Advisory, URL Repurposed x_refsource_misc
http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/

Scores

CVSS v3 8.8
EPSS 0.7332
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (1)
atutor/atutor 2.2.1 - 2.2.4
Published Jun 03, 2019
Tracked Since Feb 18, 2026