Read the docs
TI-2018-16160 Aliases CVE-2018-1999019GHSA-g5qj-4p4v-2jhc

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET…

Priority MEDIUM 48CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can result in Unauthenticated remote code execution. This attack appear to be exploitable via a simple GET request to the api endpoint. This vulnerability appears to have been fixed in After commit 0de84700648f098c1fbf6b807dee28ec640efe62.

Why it matters now

EPSS 0.03175 88th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:-:*:*:*:*:*:*1.11.0Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:alpha2:*:*:*:*:*:*1.11.0 alpha2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta1:*:*:*:*:*:*1.11.0 beta1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta2:*:*:*:*:*:*1.11.0 beta2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta3:*:*:*:*:*:*1.11.0 beta3Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta4:*:*:*:*:*:*1.11.0 beta4Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta5:*:*:*:*:*:*1.11.0 beta5Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta6:*:*:*:*:*:*1.11.0 beta6Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta7:*:*:*:*:*:*1.11.0 beta7Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.0:rc1:*:*:*:*:*:*1.11.0 rc1Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:-:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:alpha2:*:*:*:*:*:* Versions 1.11.0 alpha2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta1:*:*:*:*:*:* Versions 1.11.0 beta1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta2:*:*:*:*:*:* Versions 1.11.0 beta2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta3:*:*:*:*:*:* Versions 1.11.0 beta3 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta4:*:*:*:*:*:* Versions 1.11.0 beta4 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta5:*:*:*:*:*:* Versions 1.11.0 beta5 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta6:*:*:*:*:*:* Versions 1.11.0 beta6 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:beta7:*:*:*:*:*:* Versions 1.11.0 beta7 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.0:rc1:*:*:*:*:*:* Versions 1.11.0 rc1 Vulnerable ·chamilo
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:*1.11.2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.4:-:*:*:*:*:*:*1.11.4Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha1:*:*:*:*:*:*1.11.4 alpha1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha2:*:*:*:*:*:*1.11.4 alpha2Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.4:beta1:*:*:*:*:*:*1.11.4 beta1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.4:rc1:*:*:*:*:*:*1.11.4 rc1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.6:-:*:*:*:*:*:*1.11.6Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.6:alpha1:*:*:*:*:*:*1.11.6 alpha1Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.8:-:*:*:*:*:*:*1.11.8Vulnerablechamilo
cpe:2.3:a:chamilo:chamilo_lms:1.11.8:rc1:*:*:*:*:*:*1.11.8 rc1Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.4:-:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha1:*:*:*:*:*:* Versions 1.11.4 alpha1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.4:alpha2:*:*:*:*:*:* Versions 1.11.4 alpha2 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.4:beta1:*:*:*:*:*:* Versions 1.11.4 beta1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.4:rc1:*:*:*:*:*:* Versions 1.11.4 rc1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.6:-:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.6:alpha1:*:*:*:*:*:* Versions 1.11.6 alpha1 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.8:-:*:*:*:*:*:* Versions 1.11.8 Vulnerable ·chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:1.11.8:rc1:*:*:*:*:*:* Versions 1.11.8 rc1 Vulnerable ·chamilo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1999019
  2. 2026-10-03 Alias added: GHSA-g5qj-4p4v-2jhc

References

Patch 1

Advisory 1

  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2025-32595 Chamilo: Stored XSS Vulnerability via CSV User Import CVSS 3.1HIGH 8.8
  • TI-2024-20321 Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences