PT-2026-61663 · Chamilo · Chamilo

CVE-2026-34239 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.41

Description Authenticated users enrolled in a course, such as students, teachers, or DRH, can achieve remote code execution. The issue exists in the 'main/inc/ajax/lang.ajax.php' endpoint, which is only protected by the api protect course script(true) function, allowing unauthorized access to the execution path for any authenticated user with course enrollment.

Recommendations Update to a version newer than 1.11.40. Restrict access to the 'main/inc/ajax/lang.ajax.php' path as a temporary mitigation measure.

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-34239

Affected Products

Chamilo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34239 · Security Note
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4hwq-pv7c-3928 · Note
• https://twitter.com/VulmonFeeds/status/2079383865521471717 · Twitter Post