internet-facing-service-vulnerabilityproof-of-concept-releasewidely-deployed-product-advisoryinitial-access-method

Chamilo LMS command injection flaws enable RCE via learning path uploads

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 11, 2026

Chamilo LMS fixed two high-severity command injection vulnerabilities, CVE-2023-4221 and CVE-2023-4222, that can allow remote code execution in versions up to and including 1.11.24. The bugs affect the learning path conversion workflow: CVE-2023-4221 is in main/lp/openoffice_presentation.class.php, where attacker-controlled slide_size input is passed into an OS command, while CVE-2023-4222 is in main/lp/openoffice_text_document.class.php, where a crafted uploaded filename containing shell metacharacters is used unsafely. In both cases, exploitation requires an authenticated user with permission to upload learning paths, such as a Trainer-role user, and depends on Chamilo RAPID being enabled with service_ppt2lp set to localhost.

STAR Labs said the flaws appear related to the previously disclosed Chamilo command injection issue CVE-2023-34960 and published proof-of-concept details showing exploitation through lp_upload.php and related upload endpoints using a non-empty ppt2lp or woogie parameter. Chamilo addressed the issues in v1.11.26. Defenders are advised to upgrade and review access logs, upload activity, and database records for suspicious learning path uploads, especially requests to upload endpoints containing unusual slide_size values, non-empty conversion parameters, or malicious filenames.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Nov 28, 2023

Nov 28, 20233y ago
STAR Labs publishes advisories and exploitation details for CVE-2023-4221 and CVE-2023-4222
STAR Labs publicly disclosed the two vulnerabilities, including technical root-cause details, affected components, exploitation prerequisites, and proof-of-concept information for CVE-2023-4221. The advisories also linked the bugs to the previously disclosed Chamilo command injection issue CVE-2023-34960 and provided detection guidance for defenders.
Nov 28, 20233y ago
Chamilo releases fixes in version 1.11.26
Chamilo addressed the command injection issues with a complete fix in version 1.11.26. The fixes cover the vulnerable code paths in both openoffice_presentation.class.php and openoffice_text_document.class.php.
Nov 28, 20233y ago
Chamilo LMS command injection flaws affect versions through 1.11.24
Two related command injection vulnerabilities, CVE-2023-4221 and CVE-2023-4222, were identified in Chamilo LMS in learning path PPT2LP processing code. The flaws affect versions up to and including 1.11.24 and can allow remote code execution by authenticated users permitted to upload learning paths when Chamilo RAPID is enabled and service_ppt2lp is set to localhost.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Command Injection in Chamilo LMS openoffice_presentation.class.php (CVE-2023-4221)Command Injection in Chamilo LMS openoffice_text_document.class.php (CVE-2023-4222)

Affected products

1 linked

Chamilo Lms

Organizations

1 linked

Chamilo

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Starlabs SgNews · Nov 28, 2023

(CVE-2023-4221) Chamilo LMS Learning Path PPT2LP OpenofficePresentation Command Injection | STAR LabsOpen source ↗

Starlabs SgNews · Nov 28, 2023

(CVE-2023-4222) Chamilo LMS Learning Path PPT2LP OpenofficeTextDocument Command Injection | STAR LabsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News