Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-22241 EUVD-2026-1672

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

Published Jan 8, 2026 · Updated Jan 23, 2026 · Assigned by GitHub_M

Vendor: gunet Product: openeclass

Description

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.

Affected products

VendorProductAffectedFixed
gunet openeclass < 4.2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References