PT-2026-21308 · Unknown · Elfinder Filemanager+1

Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2018-25158

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.8

Description Chamilo LMS version 1.11.8 has an issue that allows authenticated users to upload and execute PHP files. This is possible through the elfinder filemanager module. An attacker can upload files with image headers in the social myfiles section, rename them to PHP extensions, and then execute arbitrary code by accessing these uploaded files. The vulnerable module is elfinder filemanager. The affected area is the 'social myfiles' section.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the elfinder filemanager module to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-25158

Produtos afetados

Chamilo Lms

Elfinder Filemanager

Referências · 6

• https://github.com/chamilo/chamilo-lms · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25158 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-25158 · Aviso do Fabricante
• https://t.me/cveNotify/152675 · Publicação no Telegram
• https://vulncheck.com/advisories/chamilo-lms-arbitrary-file-upload-via-elfinder · Nota
• https://exploit-db.com/exploits/47423 · Nota