PT-2026-32013 · Unknown · Chamilo Lms

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-33618

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 2.0.0-RC.3

Description Chamilo LMS, a learning management system, has an issue where the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() function to process platform settings retrieved from the database. An attacker with administrator privileges can inject arbitrary PHP code into these settings. This injected code is then executed when any user, even unauthenticated ones, accesses the '/platform-config/list' API endpoint. This allows for remote code execution.

Recommendations Upgrade to version 2.0.0-RC.3 or later.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-33618

Affected Products

Chamilo Lms

References · 6

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hp4w-jmwc-pg7w · Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/f2c382c94a3f153a4d7e5ce5686c5a219fd09b3b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33618 · Security Note
• https://twitter.com/CVEnew/status/2042710202705731971 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042769165505769988 · Twitter Post
• https://twitter.com/CveFindCom/status/2042689794711355459 · Twitter Post