PT-2026-22587 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-07 · CVE-2024-47886

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions 1.11.12 through 1.11.26

Description Chamilo is a learning management system affected by a post-authentication PHP unserialize issue that can lead to remote code execution (RCE). The vulnerability allows an administrator to execute arbitrary code on the server by abusing features within the vchamilo virtualization plugin.

Recommendations Update to version 1.11.26 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-47886

GHSA-C4FC-VJM9-9MVC

Affected Products

Chamilo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47886.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-c4fc-vjm9-9mvc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47886 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47886 · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28 · Note
• https://twitter.com/cracbot/status/2029512332150534191 · Twitter Post
• https://twitter.com/cracbot/status/2029874788018323456 · Twitter Post
• https://twitter.com/cracbot/status/2030237089586167939 · Twitter Post