Read the docs
TI-2018-15383 Aliases CVE-2018-25158GHSA-59vc-4mm8-j289

Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder

Priority HIGH 73CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamiloChamillo LMSChamilo 1.11.8 or lower to 1.8—No fix listedCNA
  • Chamillo LMS Vendorchamilo Affected Chamilo 1.11.8 or lower to 1.8 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-25158
  2. 2026-10-03 Alias added: GHSA-59vc-4mm8-j289

References

Exploit 1

Other 1

  • TI-2023-17452 A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to… CVSS 3.1CRITICAL 9.8
  • TI-2023-03150 Chamilo LMS Unauthenticated Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
See all 162 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences