Chamilo LMS (<= 1.11.24) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/chamilo-lms--1.11.24/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 21:03:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgChamilo LMS: Unauthenticated remote code execution via arbitrary file upload (CVE-2023-4220)https://feed.craftedsignal.io/briefs/2026-10-chamilo-rce/Fri, 30 Oct 2026 21:03:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-chamilo-rce/An unauthenticated arbitrary file upload vulnerability in Chamilo LMS versions 1.11.24 and earlier allows remote attackers to execute arbitrary code by uploading malicious web shells to the bigUpload.php endpoint.CVE-2023-4220 is an unauthenticated arbitrary file upload vulnerability found in Chamilo LMS versions 1.11.24 and earlier. The flaw resides in the bigUpload.php handler, which fails to adequately validate file types during the upload process. Successful exploitation allows an unauthenticated attacker to upload web shells, enabling remote code execution (RCE) or the deployment of stored cross-site scripting (XSS) payloads. Public proof-of-concept exploits are currently available.

Impact

Successful exploitation provides attackers with arbitrary remote code execution on the underlying web server, potentially leading to full system compromise, data theft, or further lateral movement within the network.

Recommendation

  • Patch Chamilo LMS to a version later than 1.11.24 immediately.
  • Implement access controls or restrict network-level access to /main/inc/lib/javascript/bigupload/inc/bigUpload.php to authorized users or internal subnets only.
  • Monitor web server access logs for anomalous POST requests targeting the bigUpload.php script.
  • Audit the web server document root and associated directories for unexpected file extensions or suspicious files created post-exploitation.
]]>highadvisoryweb-application-vulnerabilityremote-code-executionfile-uploadchamilo