Skip to content
Threat Feed

Tag

Eval-Injection

1 brief RSS
critical advisory

Chamilo LMS Unauthenticated Remote Code Execution via Configuration Injection (CVE-2026-33618)

Chamilo LMS versions prior to 2.0.0-RC.3 are vulnerable to remote code execution (RCE) via eval injection, where an authenticated administrator can inject arbitrary PHP code into platform settings that is then executed when any user (including unauthenticated) requests the /platform-config/list endpoint.

chamilo rce eval-injection cve-2026-33618
2r 1t 1c