CVE-2026-32892 chamilo CVE debrief

Who should care

System administrators and security teams responsible for Chamilo LMS installations, particularly those with teacher or course creation privileges, should prioritize patching this vulnerability to prevent potential unauthorized access, data tampering, and lateral movement within the network.

Why it matters

This vulnerability allows authenticated users with teacher privileges to execute arbitrary commands on the web server, potentially leading to unauthorized access, data tampering, and lateral movement within the network.

• Potential for arbitrary command execution as the web server user
• Possible lateral movement within the network
• Data tampering or unauthorized access
• Reputation damage due to exploitation

Technical summary

The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). An attacker can exploit this vulnerability by first creating a directory with shell metacharacters in its name via Course Backup Import, then moving a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3. Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user.

Defensive priority

High

Recommended defensive actions

• Update Chamilo LMS to version 1.11.38 or 2.0.0-RC.3
• Restrict access to the file move function to authorized users only
• Monitor for suspicious activity on the web server
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the insecure use of the exec() function in fileManage.lib.php, which passes user-controlled path values directly into shell commands without proper escaping. An attacker can exploit this vulnerability by first creating a directory with shell metacharacters in its name via Course Backup Import, then moving a document into that directory to trigger arbitrary command execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.