PHP file inclusion in Chamilo LMS - CVE-2026-54750
Published: August 4, 2026
Vulnerability identifier: #VU140924
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54750
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of filename for include/require statement in PHP program in the CStudio plugin language include logic when processing the cstudio_lang cookie value. A remote user can supply a crafted cookie and chain the issue with the plugin's file write capabilities to execute arbitrary code.
The CStudio plugin must be installed and enabled for exploitation.
Affected software
Chamilo LMS
How to mitigate CVE-2026-54750
Install security update from vendor's website.
Chamilo LMS - update to 2.0.3