Read the docs
TI-2026-83101 Aliases CVE-2026-44344

Code execution in Chamilo LMS through vendored QuickForm eval

Priority LOW 31CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-95.

Summary

Chamilo LMS versions from 1.x before 1.11.40 and from 2.0.0-alpha.1 before 2.0.1 are affected. Multiple eval() calls in the vendored PEAR HTML_QuickForm libraries can execute arbitrary PHP code (CWE-95) when form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names, so exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those names. Where that path exists, an attacker could fully compromise the server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00344 28th percentileScored 2026-11-07
Fix Fixed chamilo-lms (chamilo): 1.11.40, 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chamilochamilo-lmsbefore 1.11.40; 2.0.0-alpha.1 to before 2.0.11.11.40, 2.0.1Patch availableCNA
  • chamilo-lms Vendorchamilo Affected before 1.11.40; 2.0.0-alpha.1 to before 2.0.1 Fixed in 1.11.40, 2.0.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*——chamilo
  • cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* Versions — — ·chamilo

Remediation

Upgrade Chamilo LMS 1.x to version 1.11.40 and 2.x to version 2.0.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA chamilo-lms (chamilo) Fixed in 1.11.40, 2.0.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-44344
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-04 CISA SSVC decision points changed

References

Other 6

  • TI-2023-17452 A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to… CVSS 3.1CRITICAL 9.8
  • TI-2023-03150 Chamilo LMS Unauthenticated Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-32070 Chamilo: Evaluation of untrusted user input leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-32081 Deserialization of untrusted data in chamilo-lms CVSS 4.0HIGH 8.8
  • TI-2024-32140 Chamilo: Post-Auth Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-03907 Chamilo LMS Unauthenticated Big Upload File Remote Code Execution CVSS 3.1HIGH 8.1
See all 162 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences