Chamilo vulnerabilities
We track 66 vulnerabilities in Chamilo products across 2 products. 66 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Chamilo vulnerabilities
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30.
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30.
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an OS Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.
- 8.3 High severity
chamilo-lms: Improper Neutralization of Input During Web Page Generation
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched
- 9.8 Critical severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.
- 9.8 Critical severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.
- 8.8 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_cours
- 7.2 High severity
chamilo-lms: Improper Neutralization of Special Elements used in an SQL Command
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo
- 9.8 Critical severity
chamilo-lms: Improper Neutralization of Directives in Dynamically Evaluated Code
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
- 7.2 High severity
chamilo-lms: Deserialization of Untrusted Data
Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vcham
- 8.8 High severity
chamilo_lms: Incorrect Authorization
Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sensitive profiles information, posing a significant risk to data integrity.
- 7.1 High severity
chamilo_lms: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the new_ticket.php component.
- 8.8 High severity
Chamilo: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
- 8.8 High severity
Chamilo: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in `/main/inc/ajax/exercise.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
- 8.8 High severity
Chamilo: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in `/main/inc/ajax/dropbox.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
- 8.8 High severity
Chamilo: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload in `/main/inc/ajax/document.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.
- 8.8 High severity
Chamilo: Improper Neutralization of Special Elements used in an OS Command
Command injection in `main/lp/openoffice_text_document.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- 8.8 High severity
Chamilo: Improper Neutralization of Special Elements used in an OS Command
Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters.
- 9.8 Critical severity
Chamilo: Improper Handling of Case Sensitivity
Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess`
- 9.8 Critical severity
Chamilo: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
- 9.8 Critical severity
Chamilo: Improper Neutralization of Special Elements used in an OS Command
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
- 9.8 Critical severity
Chamilo: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.
- 9.8 Critical severity
Chamilo Lms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
- 8.8 High severity
Chamilo: Unrestricted Upload of File with Dangerous Type
Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywhere in the file system into the web directory.
- 8.8 High severity
Chamilo Lms: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.