Session Fixation Vulnerability in Chamilo LMS Learning Management System
CVE-2026-31940
7.5HIGH
What is CVE-2026-31940?
Chamilo LMS, a widely-used learning management system, is susceptible to a session fixation vulnerability due to unvalidated user-controlled request parameters being used to set the PHP session ID. This issue, occurring in the file main/lp/aicc_hacp.php, can potentially allow an attacker to hijack user sessions. Users are advised to upgrade to Chamilo LMS version 1.11.38 or 2.0.0-RC.3, where this vulnerability has been addressed and resolved.
Affected Version(s)
chamilo-lms < 1.11.38 < 1.11.38
chamilo-lms >= 2.0.0-alpha.1, < 2.0.0-RC.3 < 2.0.0-alpha.1, 2.0.0-RC.3