CVE-2026-31939: Path Traversal (Arbitrary File Delete) in Chamilo LMS

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-10 · updated 2026-10-26
Weakness: CWE-22

Description

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Affected products

chamilo-lms: before 1.11.38 — fixed in 1.11.38

How to fix

Upgrade to a fixed version: chamilo-lms 1.11.38. Check the vendor advisory for mitigations.

References

https://github.com/chamilo/chamilo-lms/commit/4dddcc19d36119da27b7c49eb84a035800abae78
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.38
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-8q8c-v75x-q2hx
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-8q8c-v75x-q2hx

Get alerted when CVE-2026-31939 or the next vulnerability affects your stack