CVE-2026-33618Disclosure(chamilo / chamilo_lms)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch chamilo chamilo_lms systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.

chamilo CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/chamilo/chamilo-lms/commit/f2c382c94a3f153a4d7e5ce5686c5a219fd09b3b

Vendor / third-party advisories

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hp4w-jmwc-pg7w

Weakness type (CWE)

CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chamilo_lms

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-10); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

chamilo

Products

chamilo_lms

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-10	2	Disclosure1General1
2026-04-11	1	Disclosure1

Full discourse3 posts

CVE@CVEnew183d
General
CVE-2026-33618 Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform … https://www.cve.org/CVERecord?id=CVE-2026-33618
Post summary
The passage notes that Chamilo LMS uses eval() in a configuration method prior to release RC.3, implying a potential code execution flaw, but provides no PoC, exploit, patch, or evidence of active exploitation.
00010100
57.0K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds183d
Disclosure
CVE-2026-33618 Remote Code Execution in Chamilo LMS Prior to 2.0.0-RC.3 via eval() Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33618
Post summary
The post announces CVE‑2026‑33618, describing a remote code execution flaw in Chamilo LMS caused by an eval() injection, but provides no PoC, exploit, or mitigation details.
0000032
4.0K followersView on X
CVEFind.com@CveFindCom183d
Disclosure
[CVE-2026-33618: HIGH] Vulnerability in Chamilo LMS prior to 2.0.0-RC.3 allows admin access for injection of PHP code via platform settings. Upgrade advised for better cybersecurity.#cve,CVE-2026-33618,#cybersecurity https://cvefind.com/CVE-2026-33618
Post summary
The post reports a HIGH‑severity vulnerability (CVE‑2026‑33618) in Chamilo LMS that allows PHP code injection through platform settings, and recommends upgrading.
0000032
619 followersView on X

CPE platform detail10 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

10 of 10 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-
App	chamilo	chamilo_lms	2.0.0	-	-

Explore more

Back to dashboard chamilo CVEs chamilo_lms vulnerabilities