{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3achamilochamilo_lms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-45140"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=5BD031A7-1596-56B4-A7CD-0362166F2282\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Chamilo LMS (\u003c= 2.0.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","web-application","critical-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Chamilo"],"content_html":"\u003cp\u003eChamilo LMS versions 2.0.0 and earlier are vulnerable to an unauthenticated remote code execution (RCE) flaw in the CStudio file upload component. The vulnerability, tracked as CVE-2026-45140, stems from a combination of path traversal (CWE-22) and unrestricted file upload (CWE-434) issues. Attackers can leverage the upload flow to store malicious files within the web document root, which can subsequently be executed by the server. This allows for total compromise of the application and potentially the underlying server infrastructure. Given the lack of required privileges and user interaction, this vulnerability represents a critical risk for deployments of Chamilo LMS. Users are strongly advised to upgrade to version 2.0.1 or later to remediate the flaw.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full server compromise, allowing unauthenticated attackers to execute arbitrary code, modify application data, and access sensitive files. The vulnerability affects all Chamilo LMS instances running version 2.0.0 or older. Given the high CVSS score of 9.8, the potential for data exfiltration and complete system takeover is high for affected organizations in the education and corporate learning sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Chamilo LMS installations to version 2.0.1 or later immediately to patch CVE-2026-45140.\u003c/li\u003e\n\u003cli\u003eAudit webserver access logs for POST requests to the CStudio upload endpoint followed by direct requests to unusual files in the application's upload directory.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for web traffic to the application to minimize exposure to unauthenticated exploitation attempts.\u003c/li\u003e\n\u003cli\u003eReview file system permissions on the web root to ensure that user-uploaded content directories do not have execution privileges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:45:20Z","date_published":"2026-09-18T01:10:40Z","id":"https://feed.craftedsignal.io/briefs/2026-09-chamilo-rce/","summary":"An unauthenticated remote code execution vulnerability in the Chamilo LMS CStudio upload flow allows attackers to gain server-level access by exploiting improper file handling (CVE-2026-45140).","title":"Chamilo LMS CStudio Unauthenticated Remote Code Execution","url":"https://feed.craftedsignal.io/briefs/2026-09-chamilo-rce/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-35196"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-KX00007-CVE-2026-35196\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["cve-2026-35196","os command injection","chamilo lms","web application"],"_cs_type":"advisory","_cs_vendors":["Chamilo"],"content_html":"\u003cp\u003eChamilo LMS, an open-source learning management system, is susceptible to an OS Command Injection vulnerability (CVE-2026-35196) in versions prior to 2.0.0-RC.3. The vulnerability resides in the \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e endpoint, specifically within the \u003ccode\u003eexport_all_certificates\u003c/code\u003e action. An attacker can exploit this flaw by manipulating the \u003ccode\u003e_cid\u003c/code\u003e session variable. Due to insufficient sanitization, the \u003ccode\u003e_cid\u003c/code\u003e value is directly concatenated into a \u003ccode\u003eshell_exec()\u003c/code\u003e command string. This allows an attacker to inject shell metacharacters and execute arbitrary commands on the underlying server. Successful exploitation could grant an attacker full access to read system files and credentials, modify the application and database, or disrupt server availability. Version 2.0.0-RC.3 addresses and resolves this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a Chamilo LMS instance running a version prior to 2.0.0-RC.3.\u003c/li\u003e\n\u003cli\u003eThe attacker gains a valid session, potentially through legitimate login or other means.\u003c/li\u003e\n\u003cli\u003eThe attacker manipulates the \u003ccode\u003e_cid\u003c/code\u003e session variable, injecting shell metacharacters (e.g., \u003ccode\u003e;\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e) and a malicious command. This can be achieved through browser developer tools or intercepting/modifying HTTP requests.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers the \u003ccode\u003eexport_all_certificates\u003c/code\u003e action in the \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe application retrieves the attacker-controlled \u003ccode\u003e_cid\u003c/code\u003e value from the session using \u003ccode\u003eapi_get_course_id()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application concatenates the unsanitized \u003ccode\u003e_cid\u003c/code\u003e value into a \u003ccode\u003eshell_exec()\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eshell_exec()\u003c/code\u003e function executes the injected command on the server.\u003c/li\u003e\n\u003cli\u003eThe attacker gains arbitrary command execution, allowing them to read sensitive files, modify the application, or disrupt the server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-35196 allows an attacker to execute arbitrary commands on the Chamilo LMS server. This could lead to the compromise of sensitive data, including system files, credentials, and database contents. An attacker can also modify the application, inject malicious code, or disrupt server availability, leading to a complete loss of confidentiality, integrity, and availability. The number of potential victims is related to the number of unpatched Chamilo LMS instances exposed to the internet. Sectors affected may include education and training organizations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Chamilo LMS to version 2.0.0-RC.3 or later to patch CVE-2026-35196.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Chamilo LMS OS Command Injection Attempt\u0026quot; to your SIEM and tune for your environment to detect attempts to exploit the vulnerability via web server logs.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests to \u003ccode\u003emain/inc/ajax/gradebook.ajax.php\u003c/code\u003e containing shell metacharacters in the \u003ccode\u003e_cid\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization for all user-supplied data, especially session variables, to prevent command injection attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T17:57:21Z","date_published":"2024-01-29T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-chamilo-os-command-injection/","summary":"Chamilo LMS versions prior to 2.0.0-RC.3 are vulnerable to OS Command Injection via the _cid session variable in the export_all_certificates action, potentially leading to arbitrary command execution.","title":"Chamilo LMS OS Command Injection Vulnerability (CVE-2026-35196)","url":"https://feed.craftedsignal.io/briefs/2024-01-chamilo-os-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}