CVE-2026-33704 chamilo CVE debrief

Who should care

Defenders responsible for Chamilo LMS instances, especially those with untrusted authenticated users, should assess exposure and apply the patch from version 1.11.38. They should prioritize verifying exposure, applying the patch, and monitoring for suspicious activity. This includes reviewing compensating controls for exposed systems and tracking exceptions.

Why it matters

CVE-2026-33704 is a Remote Code Execution vulnerability in Chamilo LMS versions prior to 1.11.38, allowing authenticated users to write arbitrary content to files on the server via the BigUpload endpoint. Defenders should prioritize verifying exposure, applying the patch, and monitoring for suspicious activity.

• Potential Remote Code Execution on vulnerable Chamilo LMS instances
• Verification of exposure required for instances with untrusted authenticated users
• Patch application priority for versions prior to 1.11.38
• Monitoring for suspicious activity on the BigUpload endpoint

Technical summary

CVE-2026-33704 is a Remote Code Execution vulnerability in Chamilo LMS versions prior to 1.11.38. The vulnerability exists in the BigUpload endpoint, where an authenticated user can write arbitrary content to files on the server. Specifically, while .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity.

Defensive priority

Defenders should prioritize verifying exposure of Chamilo LMS instances, especially those with untrusted authenticated users, and apply the patch from version 1.11.38.

Recommended defensive actions

• Verify Chamilo LMS instances for exposure, especially those with untrusted authenticated users
• Apply the patch from version 1.11.38
• Monitor for suspicious activity on the BigUpload endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and the affected versions of Chamilo LMS. The vendor has released a patch in version 1.11.38. Defenders should verify exposure of Chamilo LMS instances, especially those with untrusted authenticated users, and apply the patch from version 1.11.38. The vulnerability allows authenticated users to write arbitrary content to files on the server via the BigUpload endpoint, potentially leading to code execution on Apache configurations where .

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.