Arbitrary Code Execution Vulnerability in Chamilo LMS by Chamilo Project
CVE-2026-44344
6.6MEDIUM
What is CVE-2026-44344?
Chamilo LMS, an open-source learning management system, has a vulnerability where multiple eval() calls in the PEAR HTML_QuickForm libraries can lead to arbitrary PHP code execution. This occurs if form element names incorporate data influenced by an attacker. While standard Chamilo forms utilize hardcoded element names, exploitation is possible via poorly configured developer-specific plugins that allow user inputs to interact with those element names. If such a conditional path exists, it can lead to a complete server compromise.
Affected Version(s)
chamilo-lms < 1.11.40 < 1.11.40
chamilo-lms >= 2.0.0-alpha.1, < 2.0.1 < 2.0.0-alpha.1, 2.0.1