CVE-2026-32931 Chamilo — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	8.8 (HIGH)
Affected Versions	before 1.11.38
Fixed In	1.11.38
Type	CWE-434 (Unrestricted File Upload)
Vendor	Chamilo
Public PoC	No

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data).

This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

Low

Basic privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-434 Unrestricted File Upload

Vulnerable Products 11

Configuration	From (including)	Up to (excluding)
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms::::::::	—	`1.11.38`
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1::::::	—	—
Chamilo Chamilo_Lms cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2::::::	—	—