Loading vulnerability…
Unauthenticated file modification via exposed install directory in Chamilo LMS
CVE-2026-33698 affects Chamilo LMS versions prior to 1.11.38. The issue is a chained attack involving the main/install/ directory: if that directory remains present and is read-accessible, an attacker can enable otherwise-blocked PHP code from that installation path. Successful exploitation allows an unauthenticated remote attacker to modify existing files or create new files, subject to the underlying system's filesystem permissions. The vulnerability is specifically limited to deployments where the main/install/ directory was not removed and remains readable.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful attacker can alter application files or create new files on the server within the scope of the web application's effective permissions. This creates a high-integrity impact through unauthorized modification of application content or code, and can also affect availability if critical files are overwritten or malicious files are introduced. The provided CVSS context also indicates high confidentiality, integrity, and availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, remove the main/install/ directory from production deployments, or at minimum prevent read access to it from untrusted users. Review filesystem permissions for the web server and application account to minimize writable locations, and monitor for unauthorized file modifications or unexpected newly created files under the Chamilo installation tree.
Patch, then assume compromise.
Upgrade Chamilo LMS to version 1.11.38 or later, which fixes this vulnerability. Ensure the main/install/ directory is not left deployed on production systems unless explicitly required and securely restricted.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.