Vulnerability in Chamilo Chamilo-lms
CVE-2026-33698
Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where…
EPSS: 0.001 (30.9th percentile) — read the EPSS interpretation.
Affected products
- Chamilo Chamilo-lms — versions < 1.11.38
Weakness classification (CWE)
References
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-557g-2w66-gpmf (x_refsource_CONFIRM)
- https://github.com/chamilo/chamilo-lms/commit/d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51 (x_refsource_MISC)