Chamilo LMS Flaws Enable Unauthenticated RCE and Arbitrary File Deletion

Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to 1.11.38, including CVE-2026-33698, an unauthenticated remote code execution issue tied to the main/install/ directory, and CVE-2026-31939, a path traversal flaw in main/exercise/savescores.php that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if main/install/ remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server.

The second flaw allows user-controlled input from $_REQUEST['test'] to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under CWE-552, CWE-22, and CWE-73, and both were addressed in Chamilo LMS 1.11.38 through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.