Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)
41Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 7.3epss 3.2%
da publicação à arma41 dias
Publicada no NVD8 de jan.
1ª PoC+41d
probabilidade de exploração
3.2%top 13% das CVEs
exploração observada
nãonenhuma fonte reporta
2 exploit(s) público(s)
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
gunet · openeclassPoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/52519não verificadogithubgithub.com/CVEs-Labs/CVE-2026-22241★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/gunet/openeclass/commit/3f9d267b79812a4dd708bb1302339e6a5abe67d9https://github.com/gunet/openeclass/security/advisories/GHSA-gq72-7mwg-424rhttps://github.com/gunet/openeclass/security/advisories/GHSA-rf6j-xgqp-wjxghttps://twelvesec.com/2026/01/16/rce-via-arbitrary-file-upload-at-open-eclass/