PT-2026-32019 · Apache+1 · Apache+1

Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-33704

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chamilo LMS versions prior to 1.11.38

Description Chamilo LMS is a learning management system. Authenticated users, including students, can write arbitrary content to files on the server through the BigUpload endpoint. The key parameter controls the filename, and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension is not filtered and is handled as PHP on some Apache configurations, leading to Remote Code Execution.

Recommendations Update to version 1.11.38 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-33704

Affected Products

Apache

Chamilo Lms

References · 5

• https://github.com/chamilo/chamilo-lms/commit/9748f1ffbdb8b6dc84c0e0591c9d3c1d92e21c00 · Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-phfx-pwwg-945v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33704 · Security Note
• https://twitter.com/CVEnew/status/2042710197110554730 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042758926341472308 · Twitter Post