An arbitrary file upload vulnerability in Chamilo LMS allows authenticated attackers with teacher privileges to execute arbitrary code on the underlying server.

The application fails to properly validate uploaded H5P packages, permitting the upload of malicious files such as .htaccess or PHP scripts. This allows an authenticated user with the Teacher role to bypass security controls and achieve remote code execution via a crafted H5P package.

Successful exploitation of this vulnerability grants an attacker full control over the application server, leading to potential data theft, unauthorized modification of course materials, and total system compromise. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could severely impact the integrity and availability of educational infrastructure.

Immediate Action: Upgrade Chamilo LMS to version 1.11.36 or later to apply the necessary file validation patches.

Proactive Monitoring: Review web server access logs for suspicious file upload activity or requests targeting H5P import endpoints, particularly those originating from Teacher-level accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block uploads containing prohibited file extensions or suspicious directory configuration files like .htaccess.

Public Exploit Available: No

Given the potential for remote code execution, this vulnerability poses a significant threat to the security of the Chamilo LMS environment. Administrators should prioritize the update to version 1.11.36 immediately to eliminate the underlying flaw in the H5P import mechanism. Failure to remediate could allow malicious actors to compromise the entire learning management platform.