CVE-2026-22241
High
Description
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
SeverityHigh
CVSS7.2
Exploit probability—
ProductOpeneclass
PublishedJan 8, 2026
First seenJan 8, 2026
Weakness typeCWE-434Unrestricted upload of dangerous file type
How to fix
Update
- openeclass openeclass4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openeclass openeclass | v < 4.1 | 4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.