CVE-2026-33698 - Chamilo LMS affected by unauthenticated RCE in main/install folder

Back Back to CVE browser

CRITICAL

Chamilo LMS affected by unauthenticated RCE in main/install folder

Published Apr 10, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.58%

Description

Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38.

Affected products

Vendor Chamilo Product Chamilo-Lms Default
n/a
- Version
  < 1.11.38
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Chamilo

Chamilo-Lms

n/a

Version	Status	Constraints
< 1.11.38	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-552

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21539
Advisory
https://github.com/chamilo/chamilo-lms/commit/d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51
x_refsource_MISCPatch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-557g-2w66-gpmf
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21539		Advisory
https://github.com/chamilo/chamilo-lms/commit/d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51		x_refsource_MISCPatch
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-557g-2w66-gpmf		x_refsource_CONFIRMVendor Advisory