Chamilo LMS File Upload Flaws Let Learners Gain Remote Code Execution
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 11, 2026
Chamilo LMS disclosed high-severity unrestricted file upload vulnerabilities, CVE-2023-4225 and CVE-2023-4226, in /main/inc/ajax/exercise.ajax.php and /main/inc/ajax/work.ajax.php. The flaws affect versions up to and including 1.11.24 and allow an authenticated user with learner privileges to upload arbitrary files into the web-accessible /app/cache directory. By uploading PHP files and modifying .htaccess, an attacker can enable code execution on the server and run commands with the web server's privileges; STAR Labs demonstrated exploitation with a PHP web shell executing as www-data.
The advisories said the vulnerable logic trusted user-supplied filenames without adequate restriction and noted similar issues in related Chamilo AJAX handlers tracked as CVE-2023-4223 and CVE-2023-4224. Beyond remote code execution, the same weakness can also support stored cross-site scripting through uploaded HTML content. Chamilo addressed the issues in version 1.11.26, and defenders were urged to review requests to the affected endpoints and access to /app/cache for signs of compromise.
