PT-2026-22589 · Chamilo · Chamilo

Published 2026-03-02 · Updated 2026-03-07 · CVE-2025-50187

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.28

Description Chamilo is a learning management system. A flaw exists where a parameter from a SOAP request is evaluated without proper filtering, potentially leading to Remote Code Execution. The issue was addressed in version 1.11.28. The vulnerability involves unfiltered evaluation of input received through SOAP requests. The parameter within the SOAP request is the vulnerable component.

Recommendations Upgrade to version 1.11.28 or later to resolve this issue.

Exploit

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2025-50187

GHSA-356V-7XG2-3678

Affected Products

Chamilo

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50187.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-356v-7xg2-3678 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50187 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28 · Note
• https://twitter.com/cracbot/status/2029874789851226462 · Twitter Post
• https://twitter.com/pulsepatchio/status/2028844947940548650 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028502085151359392 · Twitter Post
• https://twitter.com/cracbot/status/2030237091184124189 · Twitter Post
• https://twitter.com/CVEnew/status/2028500218581262764 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028547881347481690 · Twitter Post
• https://twitter.com/CveFindCom/status/2028495906178265341 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028500549201744104 · Twitter Post
• https://twitter.com/cracbot/status/2029512333882753488 · Twitter Post