An authenticated remote code execution vulnerability in Chamilo LMS allows low-privileged users to execute arbitrary system commands via malicious file uploads.

The application utilizes insufficient validation for file uploads, relying only on MIME-type checks while failing to restrict file extensions or enforce secure storage. An authenticated, low-privileged user can upload a crafted file to trigger arbitrary code execution on the underlying server.

This vulnerability poses a severe risk to organizational infrastructure, as it allows for full system compromise, data theft, and unauthorized persistence within the environment. With a CVSS score of 8.8, the vulnerability is classified as High severity, reflecting the potential for total loss of confidentiality, integrity, and availability of the affected system.

Immediate Action: Upgrade Chamilo LMS to version 1.11.34 or later immediately to apply the patch for file upload validation.

Proactive Monitoring: Review web server access logs for suspicious file upload patterns, particularly requests targeting directories where user-uploaded content is stored.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file extensions and restrict execution permissions in upload directories to prevent the execution of arbitrary scripts.

Public Exploit Available: Yes — a public proof-of-concept exists via a GitHub repository.

The risk presented by this vulnerability is significant, as it grants an authenticated attacker the ability to execute arbitrary code on the server. Administrators must prioritize the upgrade to version 1.11.34 to remediate the underlying flaw in the file upload mechanism. Failure to patch this vulnerability could lead to total system compromise and unauthorized access to sensitive educational data.