Loading story…
Chamilo LMS fixed two high-severity command injection vulnerabilities, CVE-2023-4221 and CVE-2023-4222, that can allow remote code execution in versions up to and including 1.11.24. The bugs affect the learning path conversion workflow: CVE-2023-4221 is in main/lp/openoffice_presentation.class.php, where attacker-controlled slide_size input is passed into an OS command, while CVE-2023-4222 is in main/lp/openoffice_text_document.class.php, where a crafted uploaded filename containing shell metacharacters is used unsafely. In both cases, exploitation requires an authenticated user with permission to upload learning paths, such as a Trainer-role user, and depends on Chamilo RAPID being enabled with service_ppt2lp set to localhost.
STAR Labs said the flaws appear related to the previously disclosed Chamilo command injection issue CVE-2023-34960 and published proof-of-concept details showing exploitation through lp_upload.php and related upload endpoints using a non-empty ppt2lp or woogie parameter. Chamilo addressed the issues in v1.11.26. Defenders are advised to upgrade and review access logs, upload activity, and database records for suspicious learning path uploads, especially requests to upload endpoints containing unusual slide_size values, non-empty conversion parameters, or malicious filenames.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
STAR Labs publicly disclosed the two vulnerabilities, including technical root-cause details, affected components, exploitation prerequisites, and proof-of-concept information for CVE-2023-4221. The advisories also linked the bugs to the previously disclosed Chamilo command injection issue CVE-2023-34960 and provided detection guidance for defenders.
Chamilo addressed the command injection issues with a complete fix in version 1.11.26. The fixes cover the vulnerable code paths in both openoffice_presentation.class.php and openoffice_text_document.class.php.
Two related command injection vulnerabilities, CVE-2023-4221 and CVE-2023-4222, were identified in Chamilo LMS in learning path PPT2LP processing code. The flaws affect versions up to and including 1.11.24 and can allow remote code execution by authenticated users permitted to upload learning paths when Chamilo RAPID is enabled and service_ppt2lp is set to localhost.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In `CVE-2023-3545`, affecting versions through `1.11.20`, improper case-sensitive sanitization in `fileUpload.lib.php` let attackers on Windows servers running Apache bypass `.htaccess` upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as `CVE-2023-3533` for unauthenticated compromise; Chamilo fully addressed it in version `1.11.22`. A separate flaw, `CVE-2023-4223`, affected versions through `1.11.24` in `/main/inc/ajax/document.ajax.php` and allowed an authenticated learner to upload PHP files and overwrite `.htaccess` in the web-accessible `/app/cache` directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into `SYS_ARCHIVE_PATH` without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as `CVE-2023-4224`, `CVE-2023-4225`, and `CVE-2023-4226`. Chamilo released a complete fix for `CVE-2023-4223` in version `1.11.26`.
Jun 29, 2026
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to **1.11.38**, including **CVE-2026-33698**, an unauthenticated remote code execution issue tied to the `main/install/` directory, and **CVE-2026-31939**, a path traversal flaw in `main/exercise/savescores.php` that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if `main/install/` remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server. The second flaw allows user-controlled input from `$_REQUEST['test']` to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under **CWE-552**, **CWE-22**, and **CWE-73**, and both were addressed in **Chamilo LMS 1.11.38** through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Jun 29, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, `CVE-2023-4225` and `CVE-2023-4226`, in `/main/inc/ajax/exercise.ajax.php` and `/main/inc/ajax/work.ajax.php`. The flaws affect versions up to and including `1.11.24` and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible `/app/cache` directory. By uploading PHP files and modifying `.htaccess`, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as `www-data`. The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as `CVE-2023-4223` and `CVE-2023-4224`. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version `1.11.26`, and defenders were urged to review requests to the affected endpoints and access to `/app/cache` for signs of compromise.
Jun 29, 2026