What’s Vulnerable › Vulnerabilities

CVE-2026-33698: Chamilo LMS affected by unauthenticated RCE in main/install folder

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-10 · updated 2026-10-26
• Weakness: CWE-552

Description

Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38.

Affected products

• chamilo-lms: before 1.11.38 — fixed in 1.11.38

How to fix

Upgrade to a fixed version: chamilo-lms 1.11.38. Check the vendor advisory for mitigations.

References

• https://github.com/chamilo/chamilo-lms/commit/d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-557g-2w66-gpmf

Get alerted when CVE-2026-33698 or the next vulnerability affects your stack