What is CVE-2018-25158?

CVE-2018-25158 is a high-severity vulnerability in Chamilo Chamillo Lms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-20.

How severe is CVE-2018-25158?

High severity. CVSS v3 base score is 8.8 out of 10.

Arbitrary file upload in Chamilo Chamillo Lms

CVE-2018-25158

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

Vulnerability class: Unrestricted File Upload

EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Chamilo Chamillo Lms — versions Chamilo 1.11.8 or lower to 1.8

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2018-25158?: CVE-2018-25158 is a high-severity vulnerability in Chamilo Chamillo Lms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-02-20.
How severe is CVE-2018-25158?: High severity. CVSS v3 base score is 8.8 out of 10.