Loading story…
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to 1.11.38, including CVE-2026-33698, an unauthenticated remote code execution issue tied to the main/install/ directory, and CVE-2026-31939, a path traversal flaw in main/exercise/savescores.php that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if main/install/ remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server.
The second flaw allows user-controlled input from $_REQUEST['test'] to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under CWE-552, CWE-22, and CWE-73, and both were addressed in Chamilo LMS 1.11.38 through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-10, a new Chamilo LMS flaw, CVE-2026-32892, was disclosed describing an authenticated OS command injection in the document move feature caused by unsafe use of exec() in fileManage.lib.php. The issue affects versions prior to 1.11.38 and 2.0.0-RC.3 and was fixed in versions 1.11.38 and 2.0.0-RC.3.
On April 10, 2026, GitHub security advisories disclosed CVE-2026-33698, an unauthenticated RCE affecting Chamilo LMS when the main/install directory remains present and readable, and CVE-2026-31939, a path traversal vulnerability that can lead to arbitrary file deletion. Both advisories state that affected versions are those prior to 1.11.38.
Chamilo addressed two security flaws affecting versions prior to 1.11.38: an unauthenticated remote code execution issue involving the main/install directory and a path traversal flaw in main/exercise/savescores.php that could enable arbitrary file deletion. The fix was released in Chamilo LMS version 1.11.38.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026
Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In `CVE-2023-3545`, affecting versions through `1.11.20`, improper case-sensitive sanitization in `fileUpload.lib.php` let attackers on Windows servers running Apache bypass `.htaccess` upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as `CVE-2023-3533` for unauthenticated compromise; Chamilo fully addressed it in version `1.11.22`. A separate flaw, `CVE-2023-4223`, affected versions through `1.11.24` in `/main/inc/ajax/document.ajax.php` and allowed an authenticated learner to upload PHP files and overwrite `.htaccess` in the web-accessible `/app/cache` directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into `SYS_ARCHIVE_PATH` without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as `CVE-2023-4224`, `CVE-2023-4225`, and `CVE-2023-4226`. Chamilo released a complete fix for `CVE-2023-4223` in version `1.11.26`.
Jun 29, 2026
Chamilo LMS fixed two high-severity command injection vulnerabilities, **`CVE-2023-4221`** and **`CVE-2023-4222`**, that can allow remote code execution in versions up to and including **`1.11.24`**. The bugs affect the learning path conversion workflow: `CVE-2023-4221` is in `main/lp/openoffice_presentation.class.php`, where attacker-controlled `slide_size` input is passed into an OS command, while `CVE-2023-4222` is in `main/lp/openoffice_text_document.class.php`, where a crafted uploaded filename containing shell metacharacters is used unsafely. In both cases, exploitation requires an authenticated user with permission to upload learning paths, such as a Trainer-role user, and depends on **Chamilo RAPID** being enabled with `service_ppt2lp` set to `localhost`. STAR Labs said the flaws appear related to the previously disclosed Chamilo command injection issue **`CVE-2023-34960`** and published proof-of-concept details showing exploitation through `lp_upload.php` and related upload endpoints using a non-empty `ppt2lp` or `woogie` parameter. Chamilo addressed the issues in **`v1.11.26`**. Defenders are advised to upgrade and review access logs, upload activity, and database records for suspicious learning path uploads, especially requests to upload endpoints containing unusual `slide_size` values, non-empty conversion parameters, or malicious filenames.
Jun 29, 2026