CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

🗓️ 08 Jan 2026 15:07:02Reported by GoogleType

osv🔗 osv.dev👁 5 Views

CVE-2026-22241 Open eClass before 4.2 allows arbitrary file upload via theme import, enabling remote code execution.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-22241	8 Jan 202616:03	–	circl
CNNVD	Open eClass 安全漏洞	8 Jan 202600:00	–	cnnvd
CVE	CVE-2026-22241	8 Jan 202615:07	–	cve
Cvelist	CVE-2026-22241 Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)	8 Jan 202615:07	–	cvelist
Exploit DB	GUnet OpenEclass E-learning platform < 4.2 - Remote Code Execution (RCE)	29 Apr 202600:00	–	exploitdb
EUVD	EUVD-2026-1672	8 Jan 202615:07	–	euvd
NVD	CVE-2026-22241	8 Jan 202615:15	–	nvd
Packet Storm	📄 GUnet OpenEclass E-learning Remote Code Execution	5 May 202600:00	–	packetstorm
Positive Technologies	PT-2026-2178	8 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-22241	10 Jan 202605:40	–	redhatcve

Source	Link
twelvesec	www.twelvesec.com/2026/01/16/rce-via-arbitrary-file-upload-at-open-eclass/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22241.json
github	www.github.com/gunet/openeclass/security/advisories/GHSA-gq72-7mwg-424r
github	www.github.com/gunet/openeclass/security/advisories/GHSA-rf6j-xgqp-wjxg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-22241
github	www.github.com/gunet/openeclass/commit/3f9d267b79812a4dd708bb1302339e6a5abe67d9

10 Apr 2026 05:38Current

8.2High risk

Vulners AI Score8.2

CVSS 48.6

EPSS0.03076