Executive brief
Chamilo LMS, a popular open-source learning management system, contains a security flaw that allows any logged-in user, including students, to upload malicious files to the server. By exploiting this vulnerability, an attacker can execute unauthorized commands on the server, potentially leading to a full system takeover or disruption of educational services. This issue affects organizations using Chamilo to host online courses and manage student data.
Technical details
An unrestricted file upload vulnerability exists in the BigUpload endpoint of Chamilo LMS prior to version 1.11.38. The `uploadFile()` method in `main/inc/lib/javascript/bigupload/inc/bigUpload.php` reads raw POST data and writes it to a file named by the 'key' parameter. While the application attempts to sanitize filenames by renaming `.php` extensions to `.phps`, it fails to filter the `.pht` extension. On Apache web servers configured to handle `.pht` files as PHP scripts, an authenticated attacker (with low privileges) can upload a malicious script to the `/app/cache/` directory and execute it, achieving Remote Code Execution (RCE). This vulnerability is tracked as CVE-2026-33704 and is resolved in version 1.11.38.
Affected products
- Chamilo Chamilo LMS < 1.11.38
Timeline
- 2026-04-10: advisory: Vendor advisory published via GitHub
- 2026-04-10: disclosed: CVE-2026-33704 published
- 2026-04-16: other: NVD analysis and CPE enrichment completed