Path Traversal Vulnerability in Chamilo LMS Affects User Data Security

CVE-2026-31939

What is CVE-2026-31939?

Chamilo LMS, a popular learning management system, has a critical path traversal vulnerability in the savescores.php file before version 1.11.38. This issue arises when user input from the $_REQUEST['test'] variable is directly concatenated into the filesystem path, allowing attackers to bypass security measures. Without appropriate validation or canonicalization, this flaw enables the possibility of arbitrary file deletion, jeopardizing user data. It is essential for administrators to update to version 1.11.38 or later to mitigate this risk. For detailed information, visit the official security advisory page.

References