Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

INFO

Published Date :

2026-04-10T17:50:40.176Z

Last Modified :

2026-04-15T14:56:10.732Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-32931 vulnerability.

Vendors Products
Chamilo
  • Chamilo Lms
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-32931.

URL Resource
https://github.com/chamilo/chamilo-lms/commit/8cbe660de267f2b6ed625433bdfcf38dee8752b4 cve-icon cve-icon
https://github.com/chamilo/chamilo-lms/commit/d5ef5153df3d1b2de112cbeb190cdd10bea457f3 cve-icon cve-icon
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-863j-h6pf-3xhx cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact