Skip to content
Threat Feed
Subscribe
high advisory

Chamilo LMS: Unauthenticated remote code execution via arbitrary file upload (CVE-2023-4220)

An unauthenticated arbitrary file upload vulnerability in Chamilo LMS versions 1.11.24 and earlier allows remote attackers to execute arbitrary code by uploading malicious web shells to the bigUpload.php endpoint.

CVE search metadata

CVE search record: CVE-2023-4220. Severity: high. CVSS: 8.1. EPSS: 76.08%. KEV: no. Product: Chamilo LMS (<= 1.11.24). Brief: Chamilo LMS: Unauthenticated remote code execution via arbitrary file upload (CVE-2023-4220). Brief link: https://feed.craftedsignal.io/briefs/2026-10-chamilo-rce/

Triage facts

Revision 1
Applicability
Chamilo LMS (<= 1.11.24)
Evidence
Unknown
Severity
High
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 1Oct 30, 21:03 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Very likely

CVE-2023-4220 is an unauthenticated arbitrary file upload vulnerability found in Chamilo LMS versions 1.11.24 and earlier. The flaw resides in the bigUpload.php handler, which fails to adequately validate file types during the upload process. Successful exploitation allows an unauthenticated attacker to upload web shells, enabling remote code execution (RCE) or the deployment of stored cross-site scripting (XSS) payloads. Public proof-of-concept exploits are currently available.

Impact

Successful exploitation provides attackers with arbitrary remote code execution on the underlying web server, potentially leading to full system compromise, data theft, or further lateral movement within the network.

Recommendation

  • Patch Chamilo LMS to a version later than 1.11.24 immediately.
  • Implement access controls or restrict network-level access to /main/inc/lib/javascript/bigupload/inc/bigUpload.php to authorized users or internal subnets only.
  • Monitor web server access logs for anomalous POST requests targeting the bigUpload.php script.
  • Audit the web server document root and associated directories for unexpected file extensions or suspicious files created post-exploitation.

Immediate actions

Patch Chamilo LMS to a version beyond 1.11.24

IT Operations 24h

Threat Hunt

Search web logs for POST requests to /main/inc/lib/javascript/bigupload/inc/bigUpload.php resulting in HTTP 200/201.

T1190 high high confidence hunt now

Data: Web access logs containing URI stems and status codes

Mitigations

Restrict public access to bigUpload.php via WAF or web server configuration

immediate IT Operations

CVE-2023-4220

Detection coverage 1

Detect CVE-2023-4220 Exploitation - Unauthenticated File Upload to bigUpload.php

high

Detects exploitation attempts against CVE-2023-4220 by identifying POST requests to the vulnerable bigUpload.php file.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →