# CVE-2026-44344: Chamilo LMS arbitrary code execution in HTML_QuickForm

Source: https://junglewise.ai/threats/cve-2026-44344-chamilo-lms-is-an-open-source-learning-management-system-in-the-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-44344 · Severity: medium · CVSS 6.6 · Published 2026-10-30

Chamilo LMS is an open-source learning management system used for course delivery and student management. A vulnerability in the vendored PEAR HTML_QuickForm library allows arbitrary PHP code execution on the server through specially crafted form element names. This impact is limited to custom plugins or misconfigurations that expose element names to user input, but where such conditions exist, an attacker can fully compromise the server.

Technologies: [Chamilo Lms](https://junglewise.ai/threats/technologies/chamilo-lms). Vendors: [Chamilo](https://junglewise.ai/threats/vendors/chamilo).

## Quick answers

**Is CVE-2026-44344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44344 being exploited in the wild.

**How severe is CVE-2026-44344?** Medium severity, with a CVSS score of 6.6, published 30 October 2026.

**Which products and versions are affected?** Chamilo Lms 1.x before 1.11.40, 2.x before 2.0.1.

**Is there a fix for CVE-2026-44344?** Yes: fixed in 1.11.40, 2.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44344 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44344?** Check whether you run Chamilo Lms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.11.40, 2.0.1

## Technical details

The vulnerability stems from unsafe eval() calls in the HTML_QuickForm library that process form element names without proper sanitization. An attacker can inject PHP code via element names if they reach the vulnerable code path through a custom plugin or misconfiguration. Standard Chamilo deployments are protected by hardcoded element names, but any scenario allowing user-controlled input to define form element names enables remote code execution with application privileges.

## Affected products

- Chamilo LMS 1.x before 1.11.40, 2.x before 2.0.1

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/chamilo/chamilo-lms/commit/99d407a30e03c06cf764649dae85b4043877959a](https://github.com/chamilo/chamilo-lms/commit/99d407a30e03c06cf764649dae85b4043877959a)
- [https://github.com/chamilo/chamilo-lms/commit/a7fcc222bd7a7c09fb1d84173f710154c019bb7d](https://github.com/chamilo/chamilo-lms/commit/a7fcc222bd7a7c09fb1d84173f710154c019bb7d)

## Related threats

- [Chamilo LMS SQL injection via groupOp parameter](https://junglewise.ai/threats/cve-2026-45146-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS unsafe deserialization in career data](https://junglewise.ai/threats/cve-2026-45145-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS stored XSS in user profile fields](https://junglewise.ai/threats/cve-2026-45144-chamilo-lms-is-an-open-source-learning-management-system-from-2-0)
- [Chamilo LMS CSRF in skill management AJAX](https://junglewise.ai/threats/cve-2026-45141-chamilo-lms-is-an-open-source-learning-management-system-prior-to)
- [Chamilo LMS missing authorization in legacy AJAX handlers](https://junglewise.ai/threats/cve-2026-114390-chamilo-lms-from-2-0-0-alpha-1-before-2-0-0-rc-3-contains-a)