Loading story…
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, CVE-2023-4225 and CVE-2023-4226, in /main/inc/ajax/exercise.ajax.php and /main/inc/ajax/work.ajax.php. The flaws affect versions up to and including 1.11.24 and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible /app/cache directory. By uploading PHP files and modifying .htaccess, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as www-data.
The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as CVE-2023-4223 and CVE-2023-4224. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version 1.11.26, and defenders were urged to review requests to the affected endpoints and access to /app/cache for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs SG published advisories for CVE-2023-4225 and CVE-2023-4226, detailing authenticated remote code execution vulnerabilities in Chamilo LMS upload functionality and noting related issues under CVE-2023-4223 and CVE-2023-4224. The disclosure included proof-of-concept exploitation details and noted publication was delayed during coordinated disclosure because of observed in-the-wild exploitation of another Chamilo N-day vulnerability, CVE-2023-34960.
Chamilo released version 1.11.26, which fully fixed unrestricted file upload vulnerabilities affecting AJAX endpoints including /main/inc/ajax/exercise.ajax.php and /main/inc/ajax/work.ajax.php in versions up to 1.11.24. The flaws allowed authenticated learner-level users to upload PHP files and manipulate .htaccess in /app/cache, enabling remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chamilo LMS fixed multiple high-severity file upload vulnerabilities that allowed attackers to achieve remote code execution by abusing weak filename validation and unsafe handling of uploaded files. In `CVE-2023-3545`, affecting versions through `1.11.20`, improper case-sensitive sanitization in `fileUpload.lib.php` let attackers on Windows servers running Apache bypass `.htaccess` upload protections with mixed-case filenames, then configure Apache to execute uploaded files as PHP. STAR Labs said the flaw could be exploited by authenticated users with the Trainer role or chained with an arbitrary file write bug such as `CVE-2023-3533` for unauthenticated compromise; Chamilo fully addressed it in version `1.11.22`. A separate flaw, `CVE-2023-4223`, affected versions through `1.11.24` in `/main/inc/ajax/document.ajax.php` and allowed an authenticated learner to upload PHP files and overwrite `.htaccess` in the web-accessible `/app/cache` directory, leading to remote code execution and stored cross-site scripting. STAR Labs reported that user-controlled filenames were written into `SYS_ARCHIVE_PATH` without sufficient validation or dangerous file-type restrictions, and noted similar upload issues in related AJAX handlers tracked as `CVE-2023-4224`, `CVE-2023-4225`, and `CVE-2023-4226`. Chamilo released a complete fix for `CVE-2023-4223` in version `1.11.26`.
Jun 29, 2026
Chamilo LMS disclosed two high-severity vulnerabilities affecting versions prior to **1.11.38**, including **CVE-2026-33698**, an unauthenticated remote code execution issue tied to the `main/install/` directory, and **CVE-2026-31939**, a path traversal flaw in `main/exercise/savescores.php` that can be abused for arbitrary file deletion. The RCE issue stems from a chained attack that can re-enable otherwise blocked PHP execution in the installer path; if `main/install/` remains present and readable, an attacker can modify existing files or create new ones within the permissions of the web server. The second flaw allows user-controlled input from `$_REQUEST['test']` to be concatenated into a filesystem path without proper canonicalization or traversal checks, enabling deletion of arbitrary files with low attack complexity. The vulnerabilities were classified under **CWE-552**, **CWE-22**, and **CWE-73**, and both were addressed in **Chamilo LMS 1.11.38** through vendor patches and a coordinated GitHub security advisory, making upgrade and removal or restriction of exposed installer files an urgent priority for affected deployments.
Jun 29, 2026
Chamilo LMS fixed two high-severity command injection vulnerabilities, **`CVE-2023-4221`** and **`CVE-2023-4222`**, that can allow remote code execution in versions up to and including **`1.11.24`**. The bugs affect the learning path conversion workflow: `CVE-2023-4221` is in `main/lp/openoffice_presentation.class.php`, where attacker-controlled `slide_size` input is passed into an OS command, while `CVE-2023-4222` is in `main/lp/openoffice_text_document.class.php`, where a crafted uploaded filename containing shell metacharacters is used unsafely. In both cases, exploitation requires an authenticated user with permission to upload learning paths, such as a Trainer-role user, and depends on **Chamilo RAPID** being enabled with `service_ppt2lp` set to `localhost`. STAR Labs said the flaws appear related to the previously disclosed Chamilo command injection issue **`CVE-2023-34960`** and published proof-of-concept details showing exploitation through `lp_upload.php` and related upload endpoints using a non-empty `ppt2lp` or `woogie` parameter. Chamilo addressed the issues in **`v1.11.26`**. Defenders are advised to upgrade and review access logs, upload activity, and database records for suspicious learning path uploads, especially requests to upload endpoints containing unusual `slide_size` values, non-empty conversion parameters, or malicious filenames.
Jun 29, 2026