File Upload Vulnerability in Chamilo LMS Prior to Version 1.11.38
CVE-2026-33704

7.1HIGH

Key Information:

Vendor

Chamilo

Status
Chamilo-lms
Vendor
CVE Published:
10 April 2026

What is CVE-2026-33704?

Chamilo LMS, an open-source learning management system, harbors a file upload vulnerability that allows authenticated users, including students, to write arbitrary content to files on the server through the BigUpload endpoint. This vulnerability arises due to insufficient file extension filtering; while .php extensions are converted to .phps, the .pht extension is not filtered. In Apache configurations that treat .pht files as PHP scripts, attackers may exploit this flaw leading to remote code execution. The issue has been addressed in version 1.11.38.

Affected Version(s)

chamilo-lms < 1.11.38

References

https://github.com/chamilo/chamilo-lms/security/advisorie...
x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/9748f1ffbdb...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.