internet-facing-service-vulnerabilityinitial-access-methodprivilege-escalation-methodwidely-deployed-product-advisory

Chamilo LMS File Upload Flaws Enabled Remote Code Execution

Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 11, 2026

Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In CVE-2023-3545, affecting versions through 1.11.20, improper case-sensitive sanitization in fileUpload.lib.php let attackers on Windows servers running Apache bypass .htaccess upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as CVE-2023-3533 for unauthenticated compromise; Chamilo fully addressed it in version 1.11.22.

A separate flaw, CVE-2023-4223, affected versions through 1.11.24 in /main/inc/ajax/document.ajax.php and allowed an authenticated learner to upload PHP files and overwrite .htaccess in the web-accessible /app/cache directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into SYS_ARCHIVE_PATH without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as CVE-2023-4224, CVE-2023-4225, and CVE-2023-4226. Chamilo released a complete fix for CVE-2023-4223 in version 1.11.26.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 13, 2023 – Nov 28, 2023

Nov 28, 20233y ago
STAR Labs publishes advisories for Chamilo CVE-2023-3545 and CVE-2023-4223
STAR Labs SG disclosed technical details for CVE-2023-3545, a case-sensitive .htaccess upload bypass affecting Chamilo up to 1.11.20, and CVE-2023-4223, a learner-accessible file upload flaw affecting versions up to 1.11.24. The advisories described how the bugs could enable remote code execution on vulnerable deployments and noted that Chamilo had issued fixes, including version 1.11.22 for CVE-2023-3545.
Sep 27, 20233y ago
Chamilo fixes CVE-2023-4223 and related upload flaws in version 1.11.26
Chamilo released version 1.11.26 on 2023-09-27 to fully fix CVE-2023-4223, an unrestricted file upload vulnerability in document.ajax.php that could lead to remote code execution. The advisory also noted similar upload issues in related AJAX handlers tracked as CVE-2023-4224, CVE-2023-4225, and CVE-2023-4226.
Jul 13, 20233y ago
Chamilo commits case-insensitive .htaccess upload fix
A Chamilo GitHub commit dated 2023-07-13 introduced a security change to rename .htaccess files using case-insensitive replacement. The change appears related to the later-documented .htaccess upload bypass issue tracked as CVE-2023-3545.
chamilo-lms/main/inc/lib/fileUpload.lib.php at v1.11.24 · chamilo/chamilo-lms · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Authenticated RCE via Unrestricted File Upload in Chamilo LMS (CVE-2023-4223)RCE via .htaccess Upload in Chamilo LMS <= 1.11.20 (CVE-2023-3545)

Affected products

1 linked

Chamilo Lms

Organizations

1 linked

Chamilo

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Starlabs SgNews · Nov 28, 2023

(CVE-2023-3545) Chamilo LMS Htaccess File Upload Security Bypass | STAR LabsOpen source ↗

Starlabs SgNews · Nov 28, 2023

(CVE-2023-4223) Chamilo LMS Document Ajax File Upload Functionality Remote Code Execution | STAR LabsOpen source ↗

Github WebNews · Jul 13, 2023

chamilo-lms/main/inc/lib/fileUpload.lib.php at v1.11.24 · chamilo/chamilo-lms · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News