PT-2026-23634 · Chamilo · Chamilo Lms

Meng Hokseng · Publicado 2026-03-06 · Atualizado 2026-03-11 · CVE-2026-29041

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo LMS is susceptible to an authenticated remote code execution issue stemming from insufficient validation of uploaded files. The application depends on MIME-type verification for file uploads, lacking adequate file extension validation and secure server-side storage restrictions. This allows a user with limited privileges to upload a malicious file containing executable code and execute arbitrary commands on the server.

Recommendations Update to version 1.11.34 or later.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-29041

GHSA-4PC3-4W2V-VWX8

Produtos afetados

Chamilo Lms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29041.json · Exploit
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Nota
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2031686822636748944 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2029863510335967733 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2029779542315807203 · Publicação no Twitter
• https://twitter.com/dailycve/status/2031181007072768106 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2029803462783807978 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-29041 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-29041 · Nota de Segurança