An authenticated path traversal vulnerability in Chamilo LMS prior to version 1.11.38 allows attackers to delete arbitrary files, posing a significant risk to system integrity.

This flaw is a path traversal vulnerability (CWE-22) located in the main/exercise/savescores.php file. It occurs because user input from the test parameter is concatenated into a filesystem path without proper canonicalization or traversal checks, requiring a logged-in user to execute.

The ability to delete arbitrary files on the server can lead to catastrophic system instability, loss of essential data, and potential service outages. With a CVSS score of 8.3, the vulnerability is classified as High severity, reflecting the potential for significant impact on system availability and integrity if an attacker successfully triggers the deletion of critical configuration or system files.

Immediate Action: Upgrade to Chamilo LMS version 1.11.38 or later to incorporate the patch provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests directed at main/exercise/savescores.php, particularly those containing directory traversal sequences like dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing path traversal sequences to protect the vulnerable endpoint until an update is applied.

Public Exploit Available: Unknown.

Given the High severity rating and the confirmed existence of proof-of-concept material, administrators should prioritize patching this vulnerability immediately. Upgrading to version 1.11.38 is the only definitive way to eliminate the underlying flaw and prevent potential file deletion attacks.