Loading story…
Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In CVE-2023-3545, affecting versions through 1.11.20, improper case-sensitive sanitization in fileUpload.lib.php let attackers on Windows servers running Apache bypass .htaccess upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as CVE-2023-3533 for unauthenticated compromise; Chamilo fully addressed it in version 1.11.22.
A separate flaw, CVE-2023-4223, affected versions through 1.11.24 in /main/inc/ajax/document.ajax.php and allowed an authenticated learner to upload PHP files and overwrite .htaccess in the web-accessible /app/cache directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into SYS_ARCHIVE_PATH without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as CVE-2023-4224, CVE-2023-4225, and CVE-2023-4226. Chamilo released a complete fix for CVE-2023-4223 in version 1.11.26.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
STAR Labs SG disclosed technical details for CVE-2023-3545, a case-sensitive .htaccess upload bypass affecting Chamilo up to 1.11.20, and CVE-2023-4223, a learner-accessible file upload flaw affecting versions up to 1.11.24. The advisories described how the bugs could enable remote code execution on vulnerable deployments and noted that Chamilo had issued fixes, including version 1.11.22 for CVE-2023-3545.
Chamilo released version 1.11.26 on 2023-09-27 to fully fix CVE-2023-4223, an unrestricted file upload vulnerability in document.ajax.php that could lead to remote code execution. The advisory also noted similar upload issues in related AJAX handlers tracked as CVE-2023-4224, CVE-2023-4225, and CVE-2023-4226.
A Chamilo GitHub commit dated 2023-07-13 introduced a security change to rename .htaccess files using case-insensitive replacement. The change appears related to the later-documented .htaccess upload bypass issue tracked as CVE-2023-3545.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to **1.11.38**, including **CVE-2026-33698**, an unauthenticated remote code execution issue tied to the `main/install/` directory, and **CVE-2026-31939**, a path traversal flaw in `main/exercise/savescores.php` that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if `main/install/` remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server. The second flaw allows user-controlled input from `$_REQUEST['test']` to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under **CWE-552**, **CWE-22**, and **CWE-73**, and both were addressed in **Chamilo LMS 1.11.38** through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Jun 29, 2026
Chamilo LMS fixed two high-severity command injection vulnerabilities, **`CVE-2023-4221`** and **`CVE-2023-4222`**, that can allow remote code execution in versions up to and including **`1.11.24`**. The bugs affect the learning path conversion workflow: `CVE-2023-4221` is in `main/lp/openoffice_presentation.class.php`, where attacker-controlled `slide_size` input is passed into an OS command, while `CVE-2023-4222` is in `main/lp/openoffice_text_document.class.php`, where a crafted uploaded filename containing shell metacharacters is used unsafely. In both cases, exploitation requires an authenticated user with permission to upload learning paths, such as a Trainer-role user, and depends on **Chamilo RAPID** being enabled with `service_ppt2lp` set to `localhost`. STAR Labs said the flaws appear related to the previously disclosed Chamilo command injection issue **`CVE-2023-34960`** and published proof-of-concept details showing exploitation through `lp_upload.php` and related upload endpoints using a non-empty `ppt2lp` or `woogie` parameter. Chamilo addressed the issues in **`v1.11.26`**. Defenders are advised to upgrade and review access logs, upload activity, and database records for suspicious learning path uploads, especially requests to upload endpoints containing unusual `slide_size` values, non-empty conversion parameters, or malicious filenames.
Jun 29, 2026