Description Summary:
A privilege escalation vulnerability in Chamilo LMS allows authenticated students to gain administrative control by modifying their user roles via the API.

Executive Summary:
A critical privilege escalation vulnerability in Chamilo LMS allows any authenticated student to elevate their account to administrative status, posing a severe risk to platform integrity.

Vulnerability Details

CVE-ID: CVE-2026-40291

Affected Software: Chamilo LMS

Affected Versions: < 2.0.0-RC.3

Vulnerability: The flaw exists in the PUT /api/users/{id} endpoint where improper authorization checks allow authenticated users to modify their own user record. Because the roles field is included in the writable serialization group, an attacker can escalate their privileges to ROLE_ADMIN.

Business Impact

Successful exploitation grants an attacker full administrative control over the learning management system. This results in unauthorized access to sensitive student data, grades, course materials, and administrative configurations, which can lead to significant reputational damage and data privacy breaches. Given the CVSS score of 8.8, this vulnerability is categorized as high severity and requires immediate attention to prevent total system compromise.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to ensure the roles field is correctly restricted and authorization checks are properly enforced.

Proactive Monitoring: Review access logs for the /api/users/ endpoint, specifically looking for unusual PUT requests or attempts by non-administrative users to modify account roles.

Compensating Controls: Implement strict API gateway policies to restrict access to the /api/users/{id} endpoint and utilize a Web Application Firewall to block unauthorized attempts to modify sensitive user profile fields.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of exploitation via standard API calls, which do not require complex bypass techniques beyond basic request modification.

Analyst Recommendation

The ability for a standard student user to gain administrative privileges via a simple API request represents a critical security failure. Administrators must prioritize updating the Chamilo LMS instance to version 2.0.0-RC.3 immediately. Failure to patch this vulnerability leaves the entire educational environment open to full unauthorized administrative takeover.

Description Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated users to execute arbitrary commands via the gradebook export functionality.

Executive Summary:
A critical OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code on the underlying server, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-35196

Affected Software: Chamilo LMS

Affected Versions: < 2.0.0-RC.3

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) located in the main/inc/ajax/gradebook.ajax.php endpoint. By manipulating session data to inject shell metacharacters into the course ID parameter, an authenticated user can force the application to execute arbitrary commands via shell_exec().

Business Impact

The exploitation of this flaw grants an attacker full control over the application server. With a CVSS score of 8.8, this vulnerability poses a significant risk to data confidentiality, integrity, and availability, as unauthorized actors could exfiltrate sensitive student or administrative records, modify database contents, or render the learning management system completely inoperable.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or later to apply the necessary input sanitization and command escaping.

Proactive Monitoring: Monitor server access logs for suspicious activity targeting the gradebook.ajax.php endpoint and alert on any shell-related syntax appearing in session variables or request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns, such as character sequences like backticks or semicolon-delimited commands in HTTP parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository kx00007/CVE-2026-35196.

Analyst Notes: As of April 16, 2026, there is no confirmed active exploitation in the wild. However, the presence of public proof-of-concept code significantly lowers the barrier for entry for malicious actors, making the risk of exploitation highly credible.

Analyst Recommendation

Given the severity of potential remote code execution and the availability of public exploit code, administrators must prioritize patching this vulnerability immediately. Failure to update the affected software exposes the entire server infrastructure to unauthorized administrative access and potential ransomware or data theft scenarios.

Description Summary:
An unauthenticated SSRF vulnerability in the Chamilo LMS PENS plugin allows remote attackers to probe internal networks and access sensitive cloud metadata.

Executive Summary:
An unauthenticated server-side request forgery vulnerability in Chamilo LMS allows remote attackers to bypass network perimeters and potentially exfiltrate sensitive cloud instance credentials.

Vulnerability Details

CVE-ID: CVE-2026-34160

Affected Software: Chamilo LMS

Affected Versions: < 2.0.0-RC.3

Vulnerability: The vulnerability exists within the PENS plugin endpoint at public/plugin/Pens/pens.php, which lacks authentication checks and fails to validate the user-supplied package-url parameter. This enables unauthenticated attackers to force the server to perform arbitrary requests to internal network resources or cloud metadata services.

Business Impact

The ability to perform unauthenticated SSRF poses a significant risk to organizational infrastructure. With a CVSS score of 8.6, this flaw permits attackers to bypass firewalls to scan internal services, access sensitive cloud environment metadata, or steal IAM credentials, which could lead to a full compromise of the cloud instance and lateral movement within the private network.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 2.0.0-RC.3 or higher to incorporate the necessary authentication checks and input validation.

Proactive Monitoring: Monitor server access logs for unusual requests to the public/plugin/Pens/pens.php endpoint and review egress traffic logs for connections to internal IP ranges or metadata service addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious URL patterns targeting private IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 192.168.0.0/16) directed at the PENS plugin endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub.

Analyst Notes: As of April 16, 2026, there is no public information indicating active exploitation in the wild. However, the existence of a public proof-of-concept makes the risk of exploitation credible and urgent for any instance exposed to the internet.

Analyst Recommendation

Given the high CVSS severity and the ease of exploitation, this vulnerability represents an immediate threat to the confidentiality and integrity of the hosting environment. Organizations utilizing Chamilo LMS must prioritize upgrading to the patched version immediately to eliminate the SSRF vector and prevent unauthorized access to internal network resources.

Description Summary:
Chamilo LMS uses insufficiently random values to generate REST API keys, allowing unauthenticated attackers to brute-force keys by knowing a username and the approximate time of key creation.

Executive Summary:
A vulnerability in Chamilo LMS allows unauthenticated remote attackers to compromise REST API keys due to predictable random number generation, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-33710

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: This vulnerability involves the use of insufficiently random values (CWE-330) during REST API key generation. An unauthenticated attacker can effectively brute-force these keys because the randomizing function uses a static range, making the output predictable based on the timestamp and user ID.

Business Impact

The ability to successfully brute-force REST API keys grants an attacker unauthorized access to sensitive data transmitted or managed through the Chamilo LMS API. Given the CVSS score of 7.5, this high-severity flaw could lead to data exfiltration and compromise of user information, directly impacting organizational privacy and regulatory compliance.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to implement the corrected random number generation logic.

Proactive Monitoring: Review API access logs for high volumes of authentication requests originating from single IP addresses or abnormal patterns associated with specific user accounts.

Compensating Controls: If immediate patching is not feasible, restrict access to the REST API endpoints via network-level controls or a Web Application Firewall to block suspicious brute-force attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any network-adjacent attacker with knowledge of the target username and approximate account creation timeframe.

Analyst Recommendation

This vulnerability presents a clear risk to the integrity and confidentiality of the Chamilo LMS environment. Due to the ease of automation and the lack of required authentication, it is imperative that administrators prioritize updating to the patched versions. Failure to do so leaves the API exposed to trivial key discovery and subsequent unauthorized data access.

Description Summary:
Chamilo LMS uses a predictable, non-random token generation mechanism for password resets, allowing unauthenticated attackers to hijack user accounts.

Executive Summary:
A critical vulnerability in the Chamilo LMS password reset mechanism allows unauthenticated attackers to easily compute reset tokens and hijack any user account.

Vulnerability Details

CVE-ID: CVE-2026-33707

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is a cryptographic flaw where password reset tokens are generated using a static, predictable sha1($email) hash. There is no randomness, expiration, or rate limiting, enabling attackers to reset any user's password without authentication.

Business Impact

With a CVSS score of 9.4, this vulnerability is critical. Attackers can gain unauthorized access to any account, including administrative accounts, leading to full platform takeover, student and staff data exposure, and potential malicious content injection.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later.

Proactive Monitoring: Monitor for high volumes of password reset requests or suspicious account modification activity.

Compensating Controls: If immediate patching is not possible, disable the password reset feature or implement a temporary WAF rule to rate-limit reset requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is highly exploitable and allows for mass account takeover. Organizations must update their Chamilo instances immediately to secure their user base and administrative integrity.

Description Summary:
Chamilo LMS contains an improper privilege management vulnerability allowing authenticated users to escalate their status via the REST API.

Executive Summary:
An authenticated user in Chamilo LMS can exploit an API vulnerability to escalate their privileges to Teacher or Course Manager, posing a significant risk to institutional data integrity.

Vulnerability Details

CVE-ID: CVE-2026-33706

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.38

Vulnerability: This is a privilege escalation flaw (CWE-269) occurring in the update_user_from_username REST API endpoint, where any authenticated user possessing a valid API key can modify their status field. An attacker with standard student privileges can elevate their account to instructor levels, gaining unauthorized access to administrative functions.

Business Impact

The ability for a regular user to escalate privileges to a management role compromises the integrity of the learning environment and allows for unauthorized course administration. Given the CVSS score of 7.1, this is a high-severity issue that could lead to the exposure of student records or the manipulation of academic content. Organizations relying on Chamilo for sensitive training or testing should prioritize this update to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or later to incorporate the necessary privilege validation checks.

Proactive Monitoring: Review REST API access logs for unusual update_user_from_username requests, particularly those originating from accounts with student status.

Compensating Controls: Restrict access to the REST API via network-level controls or web application firewall rules if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is straightforward to execute, as it only requires an authenticated user to submit a specific request to a known endpoint.

Analyst Recommendation

This vulnerability represents a critical failure in authorization logic that can be exploited by any standard user with API access. IT administrators must treat this as a high priority and apply the 1.11.38 update immediately to prevent unauthorized privilege escalation and potential systemic abuse.

Description Summary:
Chamilo LMS allows authenticated users to achieve remote code execution via arbitrary file uploads on the BigUpload endpoint.

Executive Summary:
An authenticated remote code execution vulnerability in Chamilo LMS allows attackers to execute arbitrary code by uploading malicious files with .pht extensions.

Vulnerability Details

CVE-ID: CVE-2026-33704

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38

Vulnerability: This vulnerability involves unrestricted file uploads (CWE-434) via the BigUpload endpoint, where the system fails to properly sanitize file extensions. Any authenticated user can bypass existing filters by using the .pht extension, which executes as PHP on servers configured to process that extension.

Business Impact

The ability for an authenticated user to achieve remote code execution poses a severe risk to the confidentiality, integrity, and availability of the entire learning management system. A successful exploit could lead to full system compromise, data exfiltration, or the deployment of further malicious payloads. With a CVSS score of 7.1, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent unauthorized server-side operations.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or later to incorporate the necessary file extension filtering and security patches.

Proactive Monitoring: Review web server access logs for anomalous requests to the BigUpload endpoint, particularly those involving file uploads or unexpected extensions like .pht.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads containing prohibited extensions or to restrict access to the BigUpload endpoint to trusted administrative roles only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of bypassing file extension filters on common Apache configurations.

Analyst Recommendation

Given the potential for remote code execution, organizations running Chamilo LMS must prioritize the transition to version 1.11.38. While the vulnerability requires authentication, the risk of a malicious actor or compromised student account leveraging this flaw to gain full control of the server is significant. Please verify your current version and apply the patch as soon as possible to mitigate this critical risk.

Description Summary:
Chamilo LMS contains an IDOR vulnerability in the lp_ajax_save_item.php endpoint, allowing authenticated users to modify the Learning Path progress of other users.

Executive Summary:
An insecure direct object reference vulnerability in Chamilo LMS allows any authenticated user to maliciously manipulate the course progress and completion status of other users.

Vulnerability Details

CVE-ID: CVE-2026-33702

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The application utilizes an insecure direct object reference (IDOR) flaw within the lp_ajax_save_item.php file, which processes a user-supplied uid parameter without validating that the requester owns the target resource. This allows any authenticated user to overwrite the score, status, and completion time of any other user's learning path.

Business Impact

The ability for students to manipulate their own or others' academic progress records presents a significant risk to the integrity of institutional data and certification processes. With a CVSS score of 7.1, this high severity vulnerability could lead to fraudulent academic outcomes, unauthorized modification of records, and the degradation of trust in the learning management system.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to address the missing authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns of requests to lp_ajax_save_item.php, specifically identifying sessions that frequently modify multiple distinct user IDs.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and restrict requests to the lp_ajax_save_item.php endpoint if they contain unexpected user ID parameters or originate from unauthorized sessions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently easy to exploit as it requires only a simple manipulation of an HTTP request parameter.

Analyst Recommendation

Given the high impact on data integrity and the availability of a proof-of-concept, organizations should prioritize upgrading their Chamilo LMS installations to the patched versions. Failure to apply these updates leaves the system vulnerable to unauthorized manipulation of academic records, which may have long-term consequences for compliance and institutional reporting.

Description Summary:
Chamilo LMS contains an eval injection vulnerability in the PlatformConfigurationController that allows attackers with administrative privileges to execute arbitrary PHP code.

Executive Summary:
A critical eval injection vulnerability in Chamilo LMS allows authenticated administrators to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-33618

Affected Software: Chamilo Chamilo LMS

Affected Versions: >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The PlatformConfigurationController::decodeSettingArray() method improperly uses PHP's eval() function to parse database settings. This flaw allows an attacker with administrative access to inject malicious PHP code, which is subsequently executed when the system processes configuration data.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk of total system compromise. Successful exploitation grants the attacker the ability to execute arbitrary code with the permissions of the web server user, leading to potential data exfiltration, unauthorized system modification, and complete loss of server confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 2.0.0-RC.3 or later to resolve the improper neutralization of dynamically evaluated code.

Proactive Monitoring: Monitor system logs for unusual PHP execution patterns or modifications to platform configuration settings in the database.

Compensating Controls: Implement strict database access controls to prevent unauthorized modification of configuration settings and employ a Web Application Firewall (WAF) to block suspicious input patterns targeting configuration endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires initial administrative access, the potential for remote code execution makes it a high-priority target for lateral movement within the network.

Analyst Recommendation

Given the severity of this remote code execution flaw, organizations running affected versions of Chamilo LMS must prioritize patching to version 2.0.0-RC.3 immediately. Failure to update leaves the application susceptible to full administrative takeover, and administrators should conduct a thorough audit of their instance for any signs of unauthorized configuration changes or malicious activity.

Description Summary:
An unrestricted file upload vulnerability in the Chamilo LMS exercise sound upload function allows authenticated teachers to achieve remote code execution by uploading a malicious PHP webshell.

Executive Summary:
A critical vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code on the underlying server, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32931

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The application fails to properly validate file types during the exercise sound upload process. An authenticated user with teacher privileges can bypass security controls by spoofing the Content-Type header, allowing the upload and execution of a PHP webshell.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the web server process, typically www-data. This can lead to full system compromise, unauthorized access to sensitive educational data, and potential lateral movement within the hosting network. The CVSS score of 7.5 reflects the high impact on confidentiality, integrity, and availability, despite the requirement for authenticated access.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the necessary file validation patches.

Proactive Monitoring: Monitor web server access logs for suspicious requests to directories where uploaded files are stored, particularly those involving .php extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block file upload requests that exhibit suspicious Content-Type headers or unauthorized file extensions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it provides a direct path to remote code execution through standard application functionality.

Analyst Recommendation

Given the potential for complete server compromise, organizations running Chamilo LMS must prioritize this update. Authenticated teacher accounts serve as the primary attack vector, so administrators should also audit current user permissions while the patch is being applied to minimize the surface area for unauthorized activity.

Description Summary:
An Insecure Direct Object Reference vulnerability in the gradebook evaluation edit page allows authenticated teachers to modify evaluation settings in other courses via the editeval GET parameter.

Executive Summary:
An Insecure Direct Object Reference vulnerability in Chamilo LMS allows authenticated teachers to modify sensitive evaluation data across different courses, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-32930

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The flaw is an Insecure Direct Object Reference (CWE-639) located in the gradebook evaluation edit page. By manipulating the editeval GET parameter, any authenticated teacher can bypass authorization controls to view or alter evaluation parameters, such as names, scores, and weights, in courses they do not manage.

Business Impact

The vulnerability allows for the unauthorized modification of gradebook data, which directly impacts the integrity of academic records and institutional reporting. With a CVSS score of 7.1, this high-severity flaw could lead to systematic grade manipulation, loss of trust in the learning management system, and potential administrative overhead to audit and correct corrupted course evaluations.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the required authorization checks.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically monitoring for frequent or unusual requests involving the editeval GET parameter.

Compensating Controls: Implement Web Application Firewall rules to inspect and filter requests containing the editeval parameter if an immediate software update is operationally unfeasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user with teacher-level privileges, making it a target for internal malicious actors or compromised accounts.

Analyst Recommendation

Given the high impact on data integrity and the availability of a vendor-provided fix, organizations must prioritize patching their Chamilo LMS instances. Failure to apply these updates leaves the system exposed to unauthorized manipulation of academic evaluations, which may have long-term consequences for institutional data accuracy.

Description Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in Chamilo LMS allows authenticated teachers to delete grade results of any student by manipulating GET parameters.

Executive Summary:
An Insecure Direct Object Reference vulnerability in Chamilo LMS allows authenticated teachers to delete arbitrary student grade records, posing a significant risk to academic data integrity.

Vulnerability Details

CVE-ID: CVE-2026-32894

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The vulnerability exists in the gradebook result view page, where insufficient authorization checks on the delete_mark and resultdelete GET parameters allow any authenticated teacher to bypass course-scope restrictions and delete grade entries for any student on the platform.

Business Impact

Successful exploitation results in the unauthorized deletion of student assessment data, which compromises the integrity and availability of academic records. With a CVSS score of 7.1, this flaw is categorized as High severity, reflecting the potential for widespread data loss and the administrative burden required to restore academic records from backups.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the gradebook result view page, specifically looking for unusual patterns in the delete_mark or resultdelete parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block unauthorized attempts to modify grade-related GET parameters originating from users without appropriate administrative privileges for the specific course.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is easily triggered by manipulating URL parameters, which makes it a high-priority target for malicious actors within an educational environment.

Analyst Recommendation

Given the potential for unauthorized data destruction, system administrators must prioritize upgrading to the patched versions of Chamilo LMS. Failure to apply these updates leaves the platform vulnerable to malicious or accidental data loss, which could have severe consequences for institutional record-keeping and academic compliance.

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in its file move function, allowing authenticated users to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code with web server privileges, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32892

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is an OS Command Injection vulnerability within the move() function in fileManage.lib.php. The application fails to properly sanitize user-supplied input before passing it to shell commands, enabling any authenticated user with teacher-level access to achieve remote code execution.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands as the www-data user, leading to potential full system compromise, data exfiltration, and unauthorized modification of learning materials. With a CVSS score of 9.1, this vulnerability represents a critical threat to the confidentiality and availability of the LMS platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later to incorporate the necessary input sanitization.

Proactive Monitoring: Review web server access logs for anomalous mv or shell-related command patterns and monitor for unexpected process creation by the www-data service account.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block requests containing shell metacharacters in file path parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which allows direct OS command execution—the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their Chamilo LMS instances and restrict course creation permissions to trusted users until the update is applied to mitigate the risk of unauthorized system-level access.

Description Summary:
Chamilo LMS contains a Server-Side Request Forgery vulnerability in the Social Wall feature, allowing authenticated attackers to perform arbitrary HTTP requests to internal network resources.

Executive Summary:
A Server-Side Request Forgery vulnerability in Chamilo LMS allows authenticated attackers to perform unauthorized requests against internal infrastructure, posing a significant risk of internal network exposure.

Vulnerability Details

CVE-ID: CVE-2026-31941

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: This vulnerability is a Server-Side Request Forgery (SSRF) flaw occurring in the read_url_with_open_graph endpoint. An authenticated attacker can supply a malicious URL via the social_wall_new_msg_main POST parameter, forcing the server to conduct internal requests without proper validation.

Business Impact

The exploitation of this vulnerability could lead to severe internal network compromise, including port scanning and unauthorized access to sensitive cloud metadata services. With a CVSS score of 7.7, this is a High severity issue that, if successfully executed, could result in the exfiltration of internal configuration data or facilitate further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to Chamilo LMS version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the provided security patches.

Proactive Monitoring: Review web server and application access logs for suspicious POST requests directed at the Social Wall feature containing internal IP addresses or sensitive service URLs.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal network segments and restricted cloud metadata endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it bypasses perimeter security by leveraging the server as a proxy for internal network reconnaissance.

Analyst Recommendation

Given the high CVSS severity and the potential for internal network discovery, administrators should prioritize this update. Ensure that all instances of Chamilo LMS are patched to the specified versions to eliminate the SSRF vector and protect internal infrastructure from unauthorized requests.

Description Summary:
Chamilo LMS is vulnerable to session fixation due to improper handling of request parameters in the main/lp/aicc_hacp.php file, allowing unauthenticated attackers to manipulate user sessions.

Executive Summary:
A session fixation vulnerability in Chamilo LMS allows unauthenticated remote attackers to hijack user sessions, posing a significant risk to account integrity.

Vulnerability Details

CVE-ID: CVE-2026-31940

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.38, >= 2.0.0-alpha.1, < 2.0.0-RC.3

Vulnerability: The vulnerability exists in the main/lp/aicc_hacp.php file, where user-controlled request parameters are used to set the PHP session ID before the global bootstrap is loaded. This allows an unauthenticated attacker to force a known session ID onto a victim, leading to potential session fixation.

Business Impact

Successful exploitation allows an attacker to hijack active user sessions, including those belonging to administrative accounts. This compromise can lead to unauthorized data access, modification of educational content, and complete system takeover, justifying the CVSS score of 7.5.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 to apply the necessary security patches.

Proactive Monitoring: Review web server and application access logs for anomalous session-related requests or patterns suggesting attempted session manipulation.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious requests directed at the /main/lp/aicc_hacp.php endpoint.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable if an attacker can successfully induce a user to interact with a crafted link containing the malicious session parameter.

Analyst Recommendation

Given the potential for full account takeover, organizations running affected versions of Chamilo LMS must prioritize upgrading to the patched releases. Immediate action is required to prevent unauthorized access to sensitive institutional data and to maintain the integrity of the learning management environment.

Description Summary:
A path traversal vulnerability in Chamilo LMS allows authenticated users to delete arbitrary files on the server via the savescores.php endpoint.

Executive Summary:
An authenticated path traversal vulnerability in Chamilo LMS prior to version 1.11.38 allows attackers to delete arbitrary files, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-31939

Affected Software: Chamilo LMS

Affected Versions: < 1.11.38

Vulnerability: This flaw is a path traversal vulnerability (CWE-22) located in the main/exercise/savescores.php file. It occurs because user input from the test parameter is concatenated into a filesystem path without proper canonicalization or traversal checks, requiring a logged-in user to execute.

Business Impact

The ability to delete arbitrary files on the server can lead to catastrophic system instability, loss of essential data, and potential service outages. With a CVSS score of 8.3, the vulnerability is classified as High severity, reflecting the potential for significant impact on system availability and integrity if an attacker successfully triggers the deletion of critical configuration or system files.

Remediation Plan

Immediate Action: Upgrade to Chamilo LMS version 1.11.38 or later to incorporate the patch provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests directed at main/exercise/savescores.php, particularly those containing directory traversal sequences like dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences to protect the vulnerable endpoint until an update is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization on a commonly accessed file-handling endpoint.

Analyst Recommendation

Given the High severity rating and the confirmed existence of proof-of-concept material, administrators should prioritize patching this vulnerability immediately. Upgrading to version 1.11.38 is the only definitive way to eliminate the underlying flaw and prevent potential file deletion attacks.

Description Summary:
Chamilo LMS versions 1.11.34 and prior contain a SQL injection vulnerability in the statistics AJAX endpoint, allowing authenticated attackers to perform unauthorized data extraction.

Executive Summary:
A critical SQL injection vulnerability in Chamilo LMS allows authenticated attackers to perform unauthorized database operations and data extraction.

Vulnerability Details

CVE-ID: CVE-2026-30881

Affected Software: Chamilo LMS

Affected Versions: < 1.11.36

Vulnerability: The vulnerability exists in the statistics AJAX endpoint where the date_start and date_end parameters are improperly sanitized. An authenticated attacker can bypass intended security controls because the database escaping mechanism is neutralized by a secondary string replacement function, allowing for arbitrary SQL injection.

Business Impact

Successful exploitation of this vulnerability could lead to significant data compromise, as an attacker can perform blind time-based and conditional data extraction from the underlying database. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to full unauthorized access to sensitive institutional or user data stored within the learning management system.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.36 or later to apply the necessary security patches and fix the flawed input sanitization logic.

Proactive Monitoring: Review web server and application access logs for suspicious activity involving the statistics AJAX endpoint, particularly requests containing unusual characters or SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests until the application can be updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the bypass of standard security escaping functions, which makes manual exploitation highly reliable for an attacker with authenticated access.

Analyst Recommendation

Given the high CVSS score and the potential for complete data compromise, organizations utilizing Chamilo LMS should prioritize this update immediately. Ensure that all systems are upgraded to version 1.11.36 to eliminate the underlying injection vector and secure the database against unauthorized access.

Description Summary:
Chamilo LMS contains an arbitrary file upload vulnerability in the H5P Import feature, allowing authenticated teachers to achieve remote code execution.

Executive Summary:
An arbitrary file upload vulnerability in Chamilo LMS allows authenticated attackers with teacher privileges to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-30875

Affected Software: Chamilo LMS

Affected Versions: < 1.11.36

Vulnerability: The application fails to properly validate uploaded H5P packages, permitting the upload of malicious files such as .htaccess or PHP scripts. This allows an authenticated user with the Teacher role to bypass security controls and achieve remote code execution via a crafted H5P package.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the application server, leading to potential data theft, unauthorized modification of course materials, and total system compromise. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could severely impact the integrity and availability of educational infrastructure.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.36 or later to apply the necessary file validation patches.

Proactive Monitoring: Review web server access logs for suspicious file upload activity or requests targeting H5P import endpoints, particularly those originating from Teacher-level accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block uploads containing prohibited file extensions or suspicious directory configuration files like .htaccess.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous because it allows for direct code execution by bypassing file type restrictions, making prompt patching essential.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a significant threat to the security of the Chamilo LMS environment. Administrators should prioritize the update to version 1.11.36 immediately to eliminate the underlying flaw in the H5P import mechanism. Failure to remediate could allow malicious actors to compromise the entire learning management platform.

Description Summary:
Chamilo LMS versions prior to 1.11.34 are vulnerable to authenticated remote code execution via improper validation of uploaded files, allowing attackers to execute arbitrary commands.

Executive Summary:
An authenticated remote code execution vulnerability in Chamilo LMS allows low-privileged users to execute arbitrary system commands via malicious file uploads.

Vulnerability Details

CVE-ID: CVE-2026-29041

Affected Software: Chamilo LMS

Affected Versions: < 1.11.34

Vulnerability: The application utilizes insufficient validation for file uploads, relying only on MIME-type checks while failing to restrict file extensions or enforce secure storage. An authenticated, low-privileged user can upload a crafted file to trigger arbitrary code execution on the underlying server.

Business Impact

This vulnerability poses a severe risk to organizational infrastructure, as it allows for full system compromise, data theft, and unauthorized persistence within the environment. With a CVSS score of 8.8, the vulnerability is classified as High severity, reflecting the potential for total loss of confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.34 or later immediately to apply the patch for file upload validation.

Proactive Monitoring: Review web server access logs for suspicious file upload patterns, particularly requests targeting directories where user-uploaded content is stored.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file extensions and restrict execution permissions in upload directories to prevent the execution of arbitrary scripts.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via a GitHub repository.

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation in the wild, though the existence of a public proof-of-concept increases the risk of development of weaponized exploits. The vulnerability is inherently dangerous due to the ease of bypassing MIME-type restrictions.

Analyst Recommendation

The risk presented by this vulnerability is significant, as it grants an authenticated attacker the ability to execute arbitrary code on the server. Administrators must prioritize the upgrade to version 1.11.34 to remediate the underlying flaw in the file upload mechanism. Failure to patch this vulnerability could lead to total system compromise and unauthorized access to sensitive educational data.

Description Summary:
Chamilo LMS prior to 1.11.34 is vulnerable to stored XSS in the course description field, enabling authenticated trainers to capture administrator session tokens.

Executive Summary:
Authenticated attackers can perform account takeover of Chamilo LMS administrators by exploiting a stored cross-site scripting (XSS) vulnerability in the course description field.

Vulnerability Details

CVE-ID: CVE-2025-59543

Affected Software: Chamilo LMS

Affected Versions: Prior to version 1.11.34

Vulnerability: This flaw allows an authenticated user with trainer-level access to inject malicious JavaScript into the course description field. The payload is stored and subsequently executed in the browser of any user, including high-privileged administrators, who visits the affected course information page.

Business Impact

The CVSS score of 9.0 reflects the critical nature of this vulnerability, which facilitates full administrative account takeover. Compromise of an LMS can lead to the theft of sensitive personal identifiable information (PII) of students and staff, as well as the loss of intellectual property.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.34 or higher immediately to ensure all course fields are properly sanitized before being rendered.

Proactive Monitoring: Scan existing course descriptions for suspicious <script> or <iframe> tags and review audit logs for any unauthorized modifications to course content.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rulesets designed to detect and block common XSS patterns in POST request bodies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. The vulnerability is highly reliable for privilege escalation once an attacker has obtained initial trainer-level access.

Analyst Recommendation

Immediate patching is the only effective way to mitigate this risk. In addition to updating Chamilo, administrators should review the permissions of all users with "trainer" roles to ensure the principle of least privilege is maintained across the platform.

Description Summary:
Chamilo LMS prior to 1.11.34 contains a stored XSS vulnerability in the learning path Settings field, allowing low-privileged trainers to hijack administrator accounts.

Executive Summary:
A critical stored cross-site scripting (XSS) vulnerability in Chamilo LMS allows authenticated attackers to escalate privileges and take over administrator accounts via malicious JavaScript injection.

Vulnerability Details

CVE-ID: CVE-2025-59542

Affected Software: Chamilo LMS

Affected Versions: Prior to version 1.11.34

Vulnerability: An authenticated attacker with "trainer" or similar low-level privileges can inject malicious JavaScript into the "course learning path Settings" field. When an administrator or another user views the course information page, the script executes, enabling the exfiltration of sensitive session tokens.

Business Impact

With a CVSS score of 9.0, this vulnerability presents a high risk of account takeover (ATO). A successful attack against an administrator results in full control over the Learning Management System, including access to student records, proprietary course materials, and the ability to modify site-wide configurations.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.34 or later to address the insufficient input sanitization in the learning path settings.

Proactive Monitoring: Inspect the database for scripts or unusual HTML tags within the course learning path tables and monitor for anomalous administrative logins from unrecognized IP addresses.

Compensating Controls: Implement a robust Content Security Policy (CSP) to prevent the execution of inline scripts and restrict the domains from which external scripts can be loaded.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation. However, stored XSS in administrative interfaces is a common vector for internal privilege escalation.

Analyst Recommendation

Organizations using Chamilo LMS should apply the 1.11.34 patch immediately. Furthermore, security teams should educate course creators on secure content practices and consider implementing multi-factor authentication (MFA) to mitigate the impact of stolen session cookies.

Description Summary:
A Cross-Site Request Forgery vulnerability in Chamilo LMS allows remote attackers to delete course projects by tricking an authenticated trainer into visiting a malicious webpage.

Executive Summary:
A Cross-Site Request Forgery vulnerability in Chamilo LMS prior to version 1.11.34 permits unauthorized project deletion, posing a significant risk to course data integrity.

Vulnerability Details

CVE-ID: CVE-2025-59541

Affected Software: Chamilo LMS

Affected Versions: < 1.11.34

Vulnerability: The application suffers from a Cross-Site Request Forgery (CWE-352) vulnerability because sensitive project deletion actions rely on GET requests and lack anti-CSRF tokens. An authenticated user with trainer privileges can be manipulated into executing these destructive actions by visiting a malicious link or page.

Business Impact

The ability for an unauthorized party to delete course projects presents a risk to academic continuity and data availability. With a CVSS score of 8.1, this vulnerability is categorized as High, reflecting the potential for significant impact on system integrity and user trust within the learning management environment.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.34 or later, which includes the necessary anti-CSRF protections to prevent unauthorized actions.

Proactive Monitoring: Monitor server access logs for unusual GET requests targeting project management endpoints, especially those originating from external referrers.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter suspicious traffic and restrict access to administrative functions to known, trusted IP ranges where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently being exploited, the ease of triggering the attack through social engineering makes it a priority for remediation.

Analyst Recommendation

Given the High severity rating and the potential for unauthorized data destruction, administrators should prioritize updating to version 1.11.34 immediately. Ensuring that all administrative and trainer accounts are aware of the risks associated with clicking untrusted links will further reduce the attack surface until the update is fully deployed.

Description Summary:
A stored Cross-site Scripting (XSS) vulnerability in Chamilo LMS allows authenticated attackers to inject malicious JavaScript, leading to account takeover and data exfiltration.

Executive Summary:
A stored XSS vulnerability in Chamilo LMS versions prior to 1.11.34 permits authenticated attackers to hijack user sessions and execute unauthorized actions with the privileges of the victim.

Vulnerability Details

CVE-ID: CVE-2025-55289

Affected Software: Chamilo LMS

Affected Versions: < 1.11.34

Vulnerability: This is a stored Cross-site Scripting (CWE-79) vulnerability located within the social network and internal messaging features of the platform. An attacker with authenticated access can inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the compromised content.

Business Impact

The impact of this vulnerability is severe, as it enables full account takeover via session hijacking and the exfiltration of sensitive educational data. Given the CVSS score of 8.8, this flaw poses a high risk to organizational integrity and data confidentiality, particularly because it can be used to escalate privileges if an administrator views the malicious payload.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.34 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server access logs for anomalous requests to messaging endpoints and monitor for unusual JavaScript execution patterns within the platform.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in POST requests until the application update is fully deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the ability for an attacker to achieve full account takeover makes this a high priority for remediation.

Analyst Recommendation

Organizations utilizing Chamilo LMS must prioritize the update to version 1.11.34 immediately. Because this vulnerability allows for the compromise of administrative accounts, delaying the patch significantly increases the risk of a platform-wide security incident. Please schedule this update within the next maintenance window to effectively mitigate the risk of session hijacking and unauthorized data access.

Description Summary:
A stored cross-site scripting vulnerability in the Chamilo LMS glossary function allows authenticated teachers to execute malicious JavaScript in the context of an administrator session.

Executive Summary:
A stored cross-site scripting flaw in Chamilo LMS allows authenticated teacher accounts to compromise administrator sessions and execute unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2025-52482

Affected Software: Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: The application is susceptible to a stored cross-site scripting (CWE-79) vulnerability within the glossary function. This flaw allows an authenticated user with the Teacher role to inject malicious JavaScript, which executes when viewed by an administrator, potentially leading to unauthorized session manipulation.

Business Impact

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the learning management system. By targeting administrative accounts, an attacker could potentially gain elevated control over the platform, modify system settings, or access sensitive course and user data. The CVSS score of 8.3 reflects the high impact on confidentiality and integrity, necessitating prompt remediation to prevent administrative account compromise.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Audit administrative access logs and monitor the glossary function for suspicious script injections or unusual character sequences.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS payloads targeting the glossary endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it targets the trust relationship between teacher accounts and administrative oversight.

Analyst Recommendation

Given the potential for administrative account compromise, organizations should prioritize upgrading their Chamilo LMS instances to version 1.11.30 immediately. Administrators should also conduct a review of existing glossary entries to ensure no malicious payloads have been previously injected. Applying the patch is the only definitive method to eliminate this cross-site scripting risk.

Description Summary:
A logic vulnerability in Chamilo LMS allows authenticated users to bypass friend request workflows via an AJAX endpoint, enabling unauthorized social connections and potential privacy breaches.

Executive Summary:
A logic flaw in the Chamilo LMS social network module allows authenticated users to forcibly add other users as friends, bypassing standard access control workflows.

Vulnerability Details

CVE-ID: CVE-2025-52469

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This vulnerability involves an improper enforcement of behavioral workflow (CWE-841) within the social network module. An authenticated attacker can manipulate the friend request process by directly calling the AJAX endpoint, effectively bypassing the requirement for mutual acceptance.

Business Impact

The exploitation of this vulnerability leads to broken access control and unauthorized social manipulation within the learning management system. Given the CVSS score of 7.1, this is considered a high-severity issue because it facilitates unauthorized data exposure and potential privacy violations for all users within the platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to apply the necessary logic checks in the friend request workflow.

Proactive Monitoring: Review web server and application logs for suspicious or high-frequency calls to AJAX endpoints related to user social interactions or friend requests.

Compensating Controls: Implement WAF rules to restrict access to the social network AJAX endpoints if immediate patching is not possible, though this may impact legitimate social functionality.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of server-side validation on the affected AJAX endpoint.

Analyst Recommendation

This vulnerability poses a significant risk to user privacy and system integrity by allowing unauthorized modifications to social relationships. Administrators must prioritize upgrading to version 1.11.30 immediately to remediate the broken workflow logic and prevent potential misuse by malicious actors.

Description Summary:
Chamilo LMS versions prior to 1.11.30 contain a stored cross-site scripting (XSS) vulnerability during CSV user data imports, allowing attackers to execute malicious scripts in user contexts.

Executive Summary:
A stored cross-site scripting vulnerability in Chamilo LMS allows remote attackers to execute arbitrary code within an authenticated user session.

Vulnerability Details

CVE-ID: CVE-2025-52468

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This vulnerability involves improper neutralization of input during web page generation (CWE-79) within the CSV user data import function. Specifically, insufficient sanitization of the Last Name, First Name, and Username fields allows an attacker to inject stored XSS payloads that execute when an administrator or user views the affected profile.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute malicious scripts in the context of an authenticated user session. Given the CVSS score of 8.8, this flaw poses a significant risk to data integrity and confidentiality, as an attacker could potentially hijack user sessions, modify data, or perform unauthorized actions within the learning management system.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later, which includes the necessary input sanitization patches.

Proactive Monitoring: Review web server access logs for anomalous requests to profile pages and monitor for unusual activity originating from user accounts that frequently interact with CSV imports.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common XSS injection patterns in HTTP requests, particularly those involving file uploads or data import endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it relies on the common administrative practice of importing bulk user data via CSV files.

Analyst Recommendation

Given the high CVSS severity and the confirmed existence of proof-of-concept material, organizations running Chamilo LMS must prioritize the update to version 1.11.30. Failure to patch leaves the platform vulnerable to session hijacking and unauthorized data manipulation, which could severely compromise the integrity of the learning environment.

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in the admin module, allowing authenticated administrators to execute arbitrary system commands via the new_language parameter.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS versions prior to 1.11.30 presents a high risk of unauthorized system-level command execution by authenticated administrators.

Vulnerability Details

CVE-ID: CVE-2025-50197

Affected Software: Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) located in the /main/admin/sub_language_ajax.inc.php file. It is triggered via the POST new_language parameter and requires administrative-level authentication to exploit.

Business Impact

Successful exploitation of this flaw allows an attacker with administrative access to execute arbitrary operating system commands, potentially leading to full system compromise. Given the CVSS score of 7.2, this vulnerability represents a significant risk to the confidentiality, integrity, and availability of the learning management system and the underlying server infrastructure.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary security patches.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the sub_language_ajax.inc.php endpoint, particularly those containing shell metacharacters.

Compensating Controls: Implement strict administrative access controls and utilize a Web Application Firewall (WAF) to filter malicious input patterns targeting administrative endpoints if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains administrative privileges, as the input is not properly sanitized before being passed to system functions.

Analyst Recommendation

Organizations utilizing Chamilo LMS must prioritize the update to version 1.11.30 to remediate this command injection flaw. While the vulnerability requires administrative access, the potential for total system compromise necessitates immediate action to secure the administrative interface against malicious exploitation.

Description Summary:
Chamilo LMS versions prior to 1.11.30 contain an OS command injection vulnerability in the editinstance.php file, allowing authenticated administrators to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated administrators to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-50196

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability located in the /plugin/vchamilo/views/editinstance.php file. It is triggered by sending a malicious payload through the POST main_database parameter by a user with administrative privileges.

Business Impact

The vulnerability carries a CVSS score of 7.2, reflecting a high impact on system integrity and availability. Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server user, which could result in full system compromise, data theft, or complete disruption of the learning management platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to apply the official security patch.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the editinstance.php file, particularly those containing shell characters or unexpected string lengths in the main_database parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious input patterns in POST requests, specifically targeting OS command injection sequences.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct interaction with the host operating system shell from the application interface.

Analyst Recommendation

Given the severity of potential remote code execution, administrators should prioritize updating their Chamilo LMS instances to version 1.11.30 immediately. If an immediate update is not feasible, restrict access to the administrative dashboard to trusted IP addresses and monitor system logs for signs of unauthorized command execution.

Description Summary:
Chamilo LMS contains an OS command injection vulnerability in the manage.controller.php file, allowing authenticated administrators to execute arbitrary system commands.

Executive Summary:
A critical OS command injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary system commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-50195

Affected Software: Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) located in the /plugin/vchamilo/views/manage.controller.php file. The vulnerability requires high privileges (authenticated administrator) to trigger, as indicated by the CVSS vector PR:H.

Business Impact

The ability to execute arbitrary OS commands poses a severe risk to the confidentiality, integrity, and availability of the learning management system. Successful exploitation could allow an attacker to gain persistent access to the underlying server, exfiltrate sensitive student or faculty data, or disrupt educational services. Given the CVSS score of 7.2, this vulnerability represents a significant security risk that requires prompt attention.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the official security patch.

Proactive Monitoring: Review system access logs for unusual administrative activity and monitor for unexpected process executions originating from the web server user.

Compensating Controls: Ensure the application is running with the principle of least privilege, restricting the permissions of the web server service account to limit the potential impact of a successful command injection.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct interaction with the host operating system.

Analyst Recommendation

The presence of an OS command injection vulnerability in a widely used learning management system necessitates immediate remediation. Administrators should prioritize upgrading to version 1.11.30 to eliminate the injection vector. While the vulnerability requires administrative privileges, the potential for total system takeover makes patching an urgent security requirement to prevent unauthorized access and potential data breaches.

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in the check_parse_lang.php script, which allows an authenticated administrator to execute arbitrary system commands.

Executive Summary:
An OS Command Injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary commands on the underlying server, posing a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-50194

Affected Software: Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) located within the /main/cron/lang/check_parse_lang.php file. The flaw requires high privileges (authenticated administrator) to trigger the vulnerable function.

Business Impact

The ability to execute arbitrary OS commands on the server hosting the learning management system can lead to full system compromise, data exfiltration, and unauthorized lateral movement within the network. Given the CVSS score of 7.2, this vulnerability is classified as High severity because it provides an attacker with the capability to perform destructive actions or gain persistent access to the host environment.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.30 or later immediately to incorporate the vendor-provided patch.

Proactive Monitoring: Review web server access and error logs for unusual requests directed at the /main/cron/lang/ directory, specifically looking for shell-related characters or unexpected script execution patterns.

Compensating Controls: Implement strict file permission controls on the web root and ensure the web application service account operates with the least privilege necessary to limit the impact of potential command injection.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from improper neutralization of inputs in a script that processes language files.

Analyst Recommendation

Organizations utilizing Chamilo LMS should prioritize upgrading to version 1.11.30 to remediate this command injection flaw. While the vulnerability requires administrative access, the potential for total system compromise necessitates prompt action to secure the environment against potential exploitation.

Description Summary:
Chamilo LMS contains an OS command injection vulnerability in the import.php script, allowing authenticated administrative users to execute arbitrary system commands via the to_main_database parameter.

Executive Summary:
A critical OS command injection vulnerability in Chamilo LMS allows authenticated administrators to execute arbitrary commands on the underlying server, posing a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-50193

Affected Software: Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: The application is susceptible to OS command injection (CWE-78) within the /plugin/vchamilo/views/import.php endpoint. By manipulating the to_main_database POST parameter, an authenticated user with administrative privileges can inject malicious commands that are executed by the server with the privileges of the web application process.

Business Impact

The ability to execute arbitrary OS commands provides an attacker with full control over the affected server, potentially leading to unauthorized data exfiltration, lateral movement within the network, or complete system destruction. With a CVSS score of 7.2, this vulnerability represents a high-severity threat that directly impacts the confidentiality, integrity, and availability of the learning management platform and its associated databases.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later, as this release includes the necessary security patches to neutralize the command injection vector.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /plugin/vchamilo/views/import.php, specifically monitoring for unusual characters or command strings within the to_main_database parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious input containing shell metacharacters in HTTP POST requests.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown)

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for administrative authentication limits the initial attack surface, but the potential for total system compromise makes this a high-priority remediation.

Analyst Recommendation

Given the severity of OS command injection and the availability of a vendor-supplied patch, organizations must prioritize upgrading their Chamilo LMS instances to version 1.11.30 immediately. Administrators should verify the integrity of their environments for any signs of unauthorized access, as the existence of a proof-of-concept increases the likelihood of opportunistic exploitation attempts in the near term.

Description Summary:
Chamilo LMS contains an error-based SQL injection vulnerability in the hotpotatoes.php script, allowing privileged users to execute unauthorized database queries.

Executive Summary:
Chamilo LMS versions prior to 1.11.30 are vulnerable to an error-based SQL injection that may allow an authenticated attacker with high privileges to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-50191

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: This is an SQL injection vulnerability (CWE-89) located in the /main/exercise/hotpotatoes.php script. The vulnerability is triggered via the userFile parameter in a POST request and requires high privileges (PR:H) to exploit.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to extract sensitive information from the backend database or manipulate application logic. Given the CVSS score of 7.2, the risk is classified as High, reflecting the potential for significant data loss or unauthorized access to the learning management system records.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.30 or later to include the vendor-supplied security patch.

Proactive Monitoring: Review web server and application error logs for suspicious POST requests directed at hotpotatoes.php, specifically looking for SQL syntax errors.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP POST parameters.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input passed to the database query is not properly neutralized.

Analyst Recommendation

The presence of a known proof-of-concept for this SQL injection flaw necessitates prompt action. Administrators should prioritize upgrading to version 1.11.30 immediately to eliminate the vulnerable code path and protect the integrity of the Chamilo LMS environment.

Description Summary:
Chamilo LMS versions prior to 1.11.30 are vulnerable to SQL injection via the /main/coursecopy/copy_course_session_selected.php endpoint, allowing attackers to modify database query logic.

Executive Summary:
An SQL injection vulnerability in Chamilo LMS versions prior to 1.11.30 allows authenticated attackers to manipulate database queries, potentially leading to unauthorized data access or system compromise.

Vulnerability Details

CVE-ID: CVE-2025-50189

Affected Software: Chamilo, Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: The application fails to properly validate user-supplied input within the POST parameters of the /main/coursecopy/copy_course_session_selected.php script. This flaw allows an authenticated attacker to inject arbitrary SQL statements, thereby altering the intended database query logic.

Business Impact

Successful exploitation of this vulnerability can lead to the unauthorized disclosure or corruption of sensitive institutional data stored within the learning management system. Given the CVSS score of 8.8, this is a high-severity issue that could result in significant operational disruption and a breach of data confidentiality. Organizations relying on Chamilo for academic or corporate training must treat this as a priority to prevent potential database-level compromise.

Remediation Plan

Immediate Action: Update the Chamilo LMS installation to version 1.11.30 or later, as this release includes the necessary input validation fixes.

Proactive Monitoring: Review database access logs for unusual query patterns or syntax errors that may indicate injection attempts targeting the course copy module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads directed at the vulnerable PHP endpoint.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any authenticated user who has access to the course management functions.

Analyst Recommendation

The vulnerability presents a significant risk to the integrity of the Chamilo platform. Administrators should prioritize the update to version 1.11.30 immediately to eliminate the underlying flaw. Until the patch is applied, ensure that access to the learning management system is strictly restricted to trusted users to mitigate the risk of exploitation by malicious actors.

Description Summary:
Chamilo LMS versions prior to 1.11.30 contain an SQL injection vulnerability in the vchamilo plugin, allowing authenticated administrative attackers to manipulate database queries.

Executive Summary:
An SQL injection vulnerability in Chamilo LMS versions prior to 1.11.30 allows an authenticated administrative attacker to execute arbitrary SQL commands against the database.

Vulnerability Details

CVE-ID: CVE-2025-50188

Affected Software: Chamilo Chamilo LMS

Affected Versions: < 1.11.30

Vulnerability: The application fails to properly validate input provided to the GET value parameters within the syncparams.php and service.php scripts, enabling SQL injection. This vulnerability requires the attacker to hold administrative privileges to successfully trigger the flaw.

Business Impact

The ability to inject arbitrary SQL statements poses a severe risk to the confidentiality and integrity of the learning management system. Successful exploitation could lead to unauthorized data extraction, modification of sensitive user records, or potential disruption of service. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the significant impact on database security and the potential for complete compromise of the application data layer.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.30 or later to apply the necessary input validation patches.

Proactive Monitoring: Inspect web access logs for anomalous GET requests targeting the /plugin/vchamilo/ directory, specifically looking for SQL syntax patterns or unexpected parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP GET requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it involves direct manipulation of database query logic via unvalidated user input.

Analyst Recommendation

Given the high severity of this SQL injection flaw and the existence of a proof-of-concept, organizations must prioritize the update to version 1.11.30. Administrators should verify the integrity of their database after patching to ensure no unauthorized modifications have occurred, and restrict administrative access to the affected plugin endpoints as a defensive measure.

Description Summary:
Chamilo LMS is vulnerable to Remote Code Execution via an unvetted SOAP request parameter, allowing unauthenticated attackers to execute arbitrary commands on the host server.

Executive Summary:
Chamilo LMS versions prior to 1.11.28 are vulnerable to unauthenticated Remote Code Execution (RCE) via a SOAP request, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2025-50187

Affected Software: Chamilo LMS

Affected Versions: Prior to version 1.11.28

Vulnerability: The vulnerability exists due to the improper evaluation of parameters within SOAP requests. An unauthenticated remote attacker can submit a specially crafted SOAP payload that the application evaluates without sufficient filtering, leading to arbitrary code execution.

Business Impact

The ability to execute remote code allows an attacker to compromise the underlying server, access the database, and potentially pivot into the internal network. With a CVSS score of 9.8, the impact is catastrophic, involving the potential loss of all student and institutional data and total system downtime.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.28 or higher immediately to address the insecure parameter evaluation in the SOAP interface.

Proactive Monitoring: Monitor server logs for unusual SOAP requests or unexpected outbound network connections from the LMS web server, which may indicate a successful compromise.

Compensating Controls: Restrict access to the SOAP API endpoints at the network level or via a WAF to only allow traffic from trusted, known IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, Remote Code Execution vulnerabilities in Learning Management Systems are frequently targeted by threat actors once disclosed.

Analyst Recommendation

The severity of an unauthenticated RCE cannot be overstated. IT administrators should prioritize the deployment of version 1.11.28 and verify that all SOAP-related endpoints are properly secured or restricted to minimize the attack surface.

Description Summary:
Chamilo LMS is vulnerable to remote code execution via post-authentication phar deserialization, allowing an administrator to execute arbitrary code on the server through the virtualization plugin.

Executive Summary:
An authenticated remote code execution vulnerability in Chamilo LMS versions 1.11.12 through 1.11.26 poses a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2024-47886

Affected Software: Chamilo Chamilo LMS

Affected Versions: >= 1.11.12, < 1.11.28

Vulnerability: The software is affected by a deserialization of untrusted data (CWE-502) within the vchamilo virtualization plugin, which allows an authenticated administrator to achieve remote code execution.

Business Impact

A successful exploit allows an attacker with administrative privileges to execute arbitrary commands on the underlying host operating system. Given the CVSS score of 7.2, this vulnerability facilitates full system compromise, potentially leading to unauthorized data access, lateral movement within the network, and complete loss of control over the learning management system.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to version 1.11.28 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Monitor server logs for unusual processes or unauthorized file system modifications initiated by the web server user.

Compensating Controls: Restrict administrative access to the Chamilo dashboard to trusted IP addresses only, and employ a Web Application Firewall to block suspicious serialized object strings in request parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw relies on the abuse of supported features in the virtualization plugin, making it a targeted vector for privileged attackers.

Analyst Recommendation

The risk posed by this vulnerability is significant, as it grants an attacker full code execution capabilities. Organizations using affected versions of Chamilo LMS must prioritize the update to version 1.11.28 immediately to mitigate the threat of server compromise.

Description Summary:
Chamilo LMS 1.11.8 and earlier versions contain an arbitrary file upload vulnerability allowing authenticated users to execute malicious PHP code via the elfinder filemanager module.

Executive Summary:
A critical arbitrary file upload vulnerability in Chamilo LMS allows authenticated attackers to execute remote code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2018-25158

Affected Software: Chamilo LMS

Affected Versions: 1.8 through 1.11.8

Vulnerability: The application fails to properly validate file types within the elfinder filemanager module. An authenticated user can upload a file masquerading as an image, rename it to a PHP extension, and subsequently execute it to achieve remote code execution.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary commands on the server hosting the Learning Management System. This can lead to total system compromise, unauthorized access to sensitive student or institutional data, and the potential for lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high-risk threat to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: Upgrade Chamilo LMS to the latest supported version where this vulnerability is resolved. Ensure that all temporary upload directories are configured with no-execute permissions to prevent the execution of uploaded scripts.

Proactive Monitoring: Review web server access logs for requests targeting the elfinder filemanager or unusual file access patterns in the uploads directory. Monitor for suspicious PHP files created in user-accessible folders.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests that attempt to upload files with dangerous extensions or inconsistent MIME types. Restrict file upload functionality to trusted users and enforce strict server-side validation of file content.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Exploit-DB entry 47423.

Analyst Notes: As of February 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the file upload and renaming process.

Analyst Recommendation

The presence of a public proof-of-concept, combined with the potential for remote code execution, necessitates immediate attention. Administrators must prioritize updating the Chamilo LMS software to a patched version to eliminate this attack vector. Failure to remediate this issue leaves the application vulnerable to full server compromise by any authenticated user.