PT-2026-2178 · Unknown · Open Eclass

Ashifcoder · Publicado 2026-01-08 · Atualizado 2026-01-22 · CVE-2026-22241

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, is a course management system. Prior to version 4.2, a flaw exists in the theme import functionality that allows an attacker with administrative privileges to upload arbitrary files to the server's file system. This is due to a lack of validation or sanitization of files within uploaded zip archives, potentially leading to remote code execution on the web server.

Recommendations Versions prior to 4.2 should be updated to version 4.2 or later.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-22241

GHSA-GQ72-7MWG-424R

GHSA-RF6J-XGQP-WJXG

Produtos afetados

Open Eclass

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22241.json · Exploit
• 🔥 https://github.com/gunet/openeclass/security/advisories/GHSA-gq72-7mwg-424r · Exploit
• 🔥 https://github.com/gunet/openeclass/security/advisories/GHSA-rf6j-xgqp-wjxg · Exploit
• 🔥 https://twelvesec.com/2026/01/16/rce-via-arbitrary-file-upload-at-open-eclass · Exploit
• https://github.com/gunet/openeclass/commit/3f9d267b79812a4dd708bb1302339e6a5abe67d9 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22241 · Nota de Segurança
• https://t.me/cveNotify/149539 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-22241 · Aviso do Fabricante
• https://t.me/cveNotify/149313 · Publicação no Telegram
• https://t.me/CVEtracker/41733 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2009291490128699563 · Publicação no Twitter
• https://twitter.com/Ashif1337/status/2012078237938294993 · Publicação no Twitter