Arbitrary file upload in Chamilo LMS - CVE-2026-33704
Published: April 24, 2026
Vulnerability identifier: #VU127554
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33704
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write arbitrary files and execute arbitrary code.
The vulnerability exists due to unrestricted upload of file with dangerous type in the BigUpload endpoint when handling crafted upload requests. A remote user can send a specially crafted request to write arbitrary files and execute arbitrary code.
Code execution is possible on Apache configurations where .pht files are handled as PHP. Path traversal is blocked, limiting writes to the cache directory.
Affected software
Chamilo LMS
How to mitigate CVE-2026-33704
Install security update from vendor's website.
Chamilo LMS - update to 1.11.38