CVE-2019-12169

ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.

• CWE-22

• http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/Exploit, Third Party Advisory, URL Repurposed
• http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/fuzzloveThird Party Advisory
• https://github.com/fuzzlove/ATutor-2.2.4-Language-ExploitExploit, Third Party Advisory
• http://incidentsecurity.com/atutor-2-2-4-language_import-arbitrary-file-upload-rce/Exploit, Third Party Advisory, URL Repurposed
• http://packetstormsecurity.com/files/153870/ATutor-2.2.4-Arbitrary-File-Upload-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/158246/ATutor-2.2.4-Directory-Traversal-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/fuzzloveThird Party Advisory
• https://github.com/fuzzlove/ATutor-2.2.4-Language-ExploitExploit, Third Party Advisory

Published

Jun 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12162Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash…
• CVE-2019-12163GAT-Ship Web Module through 1.30 allows remote attackers to …5.3
• CVE-2019-12164ubuntu-server.js in Status React Native Desktop before v0.57…
• CVE-2019-12165MiCollab 7.3 PR2 (7.3.0.204) and earlier, 7.2 (7.2.2.13) and…9.8
• CVE-2019-12167httpGetSet/httpGet.htm on Emerson Network Power Liebert Chal…
• CVE-2019-12168Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow r…
• CVE-2019-1217A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-12170ATutor through 2.2.4 is vulnerable to arbitrary file uploads…
• CVE-2019-12171Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) i…
• CVE-2019-12172Typora 0.9.9.21.1 (1913) allows arbitrary code execution via…
• CVE-2019-12173MacDown 0.7.1 (870) allows remote code execution via a file:…
• CVE-2019-12174hide.me before 2.4.4 on macOS suffers from a privilege escal…