Executive brief
Chamilo LMS is an open-source learning management system used by educational institutions and businesses to deliver online training. A security flaw allows an attacker with administrative access to inject malicious code into the platform's settings. This code is then automatically executed whenever any user, including students or unauthenticated visitors, accesses the configuration list page, potentially leading to a total takeover of the server and theft of sensitive data.
Technical details
A remote code execution (RCE) vulnerability exists in Chamilo LMS due to the use of the dangerous PHP eval() function within the PlatformConfigurationController::decodeSettingArray() method. The application attempts to parse platform settings from the database by evaluating them as PHP code if they are not valid JSON. An attacker with administrative privileges (which may be obtained through secondary vulnerabilities) can inject arbitrary PHP code into settings such as 'catalog.course_catalog_settings'. This code is subsequently executed when any user, including unauthenticated ones, visits the /platform-config/list route. This allows for full server compromise, including the ability to execute system commands and access database credentials. The issue is fixed in version 2.0.0-RC.3 by removing the eval() call.
Affected products
- Chamilo Chamilo LMS > 1.11.*, <= 2.0-RC.2
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-33618 published
- 2026-04-17: patched: NIST analysis and CPE information updated