Read the docs
TI-2026-23704 Aliases CVE-2026-30875

Chamilo LMS: Authenticated RCE via H5P Import

Priority MEDIUM 41CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed chamilo-lms (chamilo): 1.11.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamilochamilo-lmsbefore 1.11.361.11.36Patch availableCNA
  • chamilo-lms Vendorchamilo Affected before 1.11.36 Fixed in 1.11.36 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*before 1.11.36Vulnerablechamilo
  • cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* Versions before 1.11.36 Vulnerable ·chamilo

Remediation

  • Fix · CNA chamilo-lms (chamilo) Fixed in 1.11.36

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30875
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 1

  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2025-32595 Chamilo: Stored XSS Vulnerability via CSV User Import CVSS 3.1HIGH 8.8
  • TI-2024-20321 Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. CVSS 3.1HIGH 8.8
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences