Chamilo vulnerabilities
We track 66 vulnerabilities in Chamilo products across 2 products. 66 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Chamilo vulnerabilities
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter whose groupOp field co
- 7.5 High severity
chamilo-lms: Deserialization of Untrusted Data
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_
- 8.9 High severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously reachable and renders six user-editable profile fields (`firstname`, `lastname`, `competences`, `openarea`, `teach`, and `diplomas`) inside
- 9.0 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template
- 9.8 Critical severity
chamilo-lms: Improper Limitation of a Pathname to a Restricted Directory
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or ex
- 9.3 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform
- 7.5 High severity
chamilo-lms: Improper Authorization
Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (st
- 8.8 High severity
chamilo-lms: Improper Privilege Management
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to
- 8.8 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved
- 7.1 High severity
chamilo-lms: Authorization Bypass Through User-Controlled Key
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing an authenticated attacker to modify the user parameter in the reque
- 8.6 High severity
chamilo-lms: Missing Authentication for Critical Functionality
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled packa
- 7.2 High severity
chamilo-lms: Missing Authentication for Critical Functionality
Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other AJAX endpoints, it does not include the global
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_
- 7.5 High severity
chamilo-lms: Use of Insufficiently Random Values
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectiv
- 9.8 Critical severity
chamilo-lms: Weak Password Recovery Mechanism for Forgotten Password
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compu
- 7.1 High severity
chamilo-lms: Improper Privilege Management
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (statu
- 8.8 High severity
chamilo-lms: Unrestricted Upload of File with Dangerous Type
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the
- 7.1 High severity
chamilo-lms: Authorization Bypass Through User-Controlled Key
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) pa
- 9.8 Critical severity
chamilo-lms: Files or Directories Accessible to External Parties
Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system pe
- 8.8 High severity
chamilo-lms: Improper Neutralization of Directives in Dynamically Evaluated Code
Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inje
- 8.8 High severity
chamilo-lms: Unrestricted Upload of File with Dangerous Type
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/
- 7.1 High severity
chamilo-lms: Authorization Bypass Through User-Controlled Key
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weig
- 7.1 High severity
chamilo-lms: NULL Pointer Dereference
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire pla
- 8.8 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec(
- 8.8 High severity
chamilo-lms: Session Fixation
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnera
- 8.3 High severity
chamilo-lms: Improper Limitation of a Pathname to a Restricted Directory
Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalizatio
- 8.8 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sani
- 8.8 High severity
chamilo-lms: Improper Control of Generation of Code
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks
- 9.8 Critical severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQL commands via the custom_dates parameter. By chaining this with a predictable l
- 8.8 High severity
chamilo-lms: Unrestricted Upload of File with Dangerous Type
Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when han
- 9.0 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can ex
- 9.0 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trai
- 8.1 High severity
chamilo-lms: Cross-Site Request Forgery
Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project
- 9.0 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When v
- 9.0 Critical severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account
- 9.8 Critical severity
chamilo-lms: Deserialization of Untrusted Data
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modif
- 7.1 High severity
chamilo-lms: Improper Enforcement of Behavioral Workflow
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint.
- 9.1 Critical severity
chamilo-lms: Server-Side Request Forgery
Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.