PT-2026-2178 · Unknown · Open Eclass

Ashifcoder · Published 2026-01-08 · Updated 2026-01-22 · CVE-2026-22241

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, is a course management system. Prior to version 4.2, a flaw exists in the theme import functionality that allows an attacker with administrative privileges to upload arbitrary files to the server's file system. This is due to a lack of validation or sanitization of files within uploaded zip archives, potentially leading to remote code execution on the web server.

Recommendations Versions prior to 4.2 should be updated to version 4.2 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-22241

GHSA-GQ72-7MWG-424R

GHSA-RF6J-XGQP-WJXG

Affected Products

Open Eclass

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22241.json · Exploit
• 🔥 https://github.com/gunet/openeclass/security/advisories/GHSA-gq72-7mwg-424r · Exploit
• 🔥 https://github.com/gunet/openeclass/security/advisories/GHSA-rf6j-xgqp-wjxg · Exploit
• 🔥 https://twelvesec.com/2026/01/16/rce-via-arbitrary-file-upload-at-open-eclass · Exploit
• https://github.com/gunet/openeclass/commit/3f9d267b79812a4dd708bb1302339e6a5abe67d9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22241 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22241 · Vendor Advisory
• https://t.me/cveNotify/149539 · Telegram Post
• https://t.me/cveNotify/149313 · Telegram Post
• https://t.me/CVEtracker/41733 · Telegram Post
• https://twitter.com/CVEnew/status/2009291490128699563 · Twitter Post
• https://twitter.com/Ashif1337/status/2012078237938294993 · Twitter Post