An authenticated remote code execution vulnerability in Chamilo LMS allows attackers to execute arbitrary code by uploading malicious files with .pht extensions.

This vulnerability involves unrestricted file uploads (CWE-434) via the BigUpload endpoint, where the system fails to properly sanitize file extensions. Any authenticated user can bypass existing filters by using the .pht extension, which executes as PHP on servers configured to process that extension.

The ability for an authenticated user to achieve remote code execution poses a severe risk to the confidentiality, integrity, and availability of the entire learning management system. A successful exploit could lead to full system compromise, data exfiltration, or the deployment of further malicious payloads. With a CVSS score of 7.1, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent unauthorized server-side operations.

Immediate Action: Update Chamilo LMS to version 1.11.38 or later to incorporate the necessary file extension filtering and security patches.

Proactive Monitoring: Review web server access logs for anomalous requests to the BigUpload endpoint, particularly those involving file uploads or unexpected extensions like .pht.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads containing prohibited extensions or to restrict access to the BigUpload endpoint to trusted administrative roles only.

Public Exploit Available: Unknown

Given the potential for remote code execution, organizations running Chamilo LMS must prioritize the transition to version 1.11.38. While the vulnerability requires authentication, the risk of a malicious actor or compromised student account leveraging this flaw to gain full control of the server is significant. Please verify your current version and apply the patch as soon as possible to mitigate this critical risk.