PT-2026-23634 · Chamilo · Chamilo Lms

Meng Hokseng · Published 2026-03-06 · Updated 2026-03-11 · CVE-2026-29041

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.34

Description Chamilo LMS is susceptible to an authenticated remote code execution issue stemming from insufficient validation of uploaded files. The application depends on MIME-type verification for file uploads, lacking adequate file extension validation and secure server-side storage restrictions. This allows a user with limited privileges to upload a malicious file containing executable code and execute arbitrary commands on the server.

Recommendations Update to version 1.11.34 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-29041

GHSA-4PC3-4W2V-VWX8

Affected Products

Chamilo Lms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29041.json · Exploit
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29041 · Security Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34 · Note
• https://twitter.com/cracbot/status/2031686822636748944 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029863510335967733 · Twitter Post
• https://twitter.com/CveFindCom/status/2029779542315807203 · Twitter Post
• https://twitter.com/dailycve/status/2031181007072768106 · Twitter Post
• https://twitter.com/cyberbivash/status/2029803462783807978 · Twitter Post