{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/chamilo-lms--1.11.24/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2023-4220"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Chamilo LMS (\u003c= 1.11.24)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","remote-code-execution","file-upload","chamilo"],"_cs_type":"advisory","_cs_vendors":["Chamilo"],"content_html":"\u003cp\u003eCVE-2023-4220 is an unauthenticated arbitrary file upload vulnerability found in Chamilo LMS versions 1.11.24 and earlier. The flaw resides in the bigUpload.php handler, which fails to adequately validate file types during the upload process. Successful exploitation allows an unauthenticated attacker to upload web shells, enabling remote code execution (RCE) or the deployment of stored cross-site scripting (XSS) payloads. Public proof-of-concept exploits are currently available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation provides attackers with arbitrary remote code execution on the underlying web server, potentially leading to full system compromise, data theft, or further lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Chamilo LMS to a version later than 1.11.24 immediately.\u003c/li\u003e\n\u003cli\u003eImplement access controls or restrict network-level access to /main/inc/lib/javascript/bigupload/inc/bigUpload.php to authorized users or internal subnets only.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous POST requests targeting the bigUpload.php script.\u003c/li\u003e\n\u003cli\u003eAudit the web server document root and associated directories for unexpected file extensions or suspicious files created post-exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T21:03:06Z","date_published":"2026-10-30T21:03:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-chamilo-rce/","summary":"An unauthenticated arbitrary file upload vulnerability in Chamilo LMS versions 1.11.24 and earlier allows remote attackers to execute arbitrary code by uploading malicious web shells to the bigUpload.php endpoint.","title":"Chamilo LMS: Unauthenticated remote code execution via arbitrary file upload (CVE-2023-4220)","url":"https://feed.craftedsignal.io/briefs/2026-10-chamilo-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Chamilo LMS (\u003c= 1.11.24)","version":"https://jsonfeed.org/version/1.1"}