📌 Vulnerability Summary

Open eClass (also known as GUnet eClass), a widely used open-source Learning Management System (LMS), contains a critical Unrestricted File Upload vulnerability in its Theme Import feature.

An authenticated administrator can upload a malicious ZIP file, leading to Remote Code Execution (RCE) on the server.

---

⚠️ Affected Versions

---

🛠️ Vulnerability Details

• CVE ID: CVE-2026-22241
• Severity: High (CVSS 7.3)
• Type: Unrestricted File Upload (CWE-434)
• Attack Vector: Theme Import functionality in the admin panel
• Required Privilege: Administrator account
• Impact: Remote Code Execution (RCE)

---

🔍 Root Cause

The vulnerability exists due to insufficient validation and sanitization of uploaded ZIP archives during the theme import process. Malicious files (such as PHP webshells) can be written to the web-accessible directory.

---

🛡️ Mitigation & Fix

• Upgrade immediately to Open eClass 4.2 or newer.
• Disable the Theme Import feature if not required.
• Restrict administrative access and implement strict file upload validation.
• Monitor server logs for suspicious theme upload activity.

---

📚 References

• Official Security Advisory
• NVD Entry
• TwelveSec Analysis

---

⚠️ Legal Disclaimer

This repository is intended for educational and research purposes only.
The information provided is for helping security researchers and system administrators understand and patch the vulnerability.

Unauthorized exploitation against systems you do not own is illegal.

---