Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33704 Arbitrary File Write and Remote Code Execution in Chamilo LMS Before 1.11.38 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33704
Post summary
The post announces CVE-2026-33704, noting arbitrary file write and remote code execution in Chamilo LMS versions prior to 1.11.38, with no evidence of PoC, exploitation, or patch information provided.
CVE-2026-33704 Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the … https://www.cve.org/CVERecord?id=CVE-2026-33704
Post summary
The text announces CVE-2026-33704, a file-write vulnerability in Chamilo LMS that allows authenticated users to write arbitrary content to server files on versions prior to 1.11.38. It provides basic technical details but no PoC, exploit code, patch information, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chamilo | chamilo_lms | - | - | - |