PT-2026-25799 · Chamilo · Chamilo Lms

Dhiyaneshgeek + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-30875

Mitre

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-30875

Affected Products

Chamilo Lms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-30875 · Security Note
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm · Note
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 · Note