A critical vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code on the underlying server, posing a severe risk to system integrity.

The application fails to properly validate file types during the exercise sound upload process. An authenticated user with teacher privileges can bypass security controls by spoofing the Content-Type header, allowing the upload and execution of a PHP webshell.

Successful exploitation grants an attacker the ability to execute arbitrary commands with the privileges of the web server process, typically www-data. This can lead to full system compromise, unauthorized access to sensitive educational data, and potential lateral movement within the hosting network. The CVSS score of 7.5 reflects the high impact on confidentiality, integrity, and availability, despite the requirement for authenticated access.

Immediate Action: Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 immediately to incorporate the necessary file validation patches.

Proactive Monitoring: Monitor web server access logs for suspicious requests to directories where uploaded files are stored, particularly those involving .php extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block file upload requests that exhibit suspicious Content-Type headers or unauthorized file extensions.

Public Exploit Available: No

Given the potential for complete server compromise, organizations running Chamilo LMS must prioritize this update. Authenticated teacher accounts serve as the primary attack vector, so administrators should also audit current user permissions while the patch is being applied to minimize the surface area for unauthorized activity.