What’s Vulnerable › Vulnerabilities

CVE-2024-38530: Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-12 · updated 2026-06-17
• Weakness: CWE-434

Description

The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. This vulnerability is fixed in 3.16.

Affected products

• Openeclass: before 3.16 — fixed in 3.16

How to fix

Upgrade to a fixed version: Openeclass 3.16. Check the vendor advisory for mitigations.

References

• https://github.com/gunet/openeclass/commit/4449cf8bed40fd8fc4b267a5726fab9f9fe5a191
• https://github.com/gunet/openeclass/security/advisories/GHSA-88c3-hp7p-grgg

Get alerted when CVE-2024-38530 or the next vulnerability affects your stack