8.8

CVE-2026-33618

Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Chamilo ≫ Chamilo Lms Version 2.0.0 Update alpha1
Chamilo ≫ Chamilo Lms Version 2.0.0 Update alpha2
Chamilo ≫ Chamilo Lms Version 2.0.0 Update alpha3
Chamilo ≫ Chamilo Lms Version 2.0.0 Update alpha4
Chamilo ≫ Chamilo Lms Version 2.0.0 Update alpha5
Chamilo ≫ Chamilo Lms Version 2.0.0 Update beta1
Chamilo ≫ Chamilo Lms Version 2.0.0 Update beta2
Chamilo ≫ Chamilo Lms Version 2.0.0 Update beta3
Chamilo ≫ Chamilo Lms Version 2.0.0 Update rc1
Chamilo ≫ Chamilo Lms Version 2.0.0 Update rc2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.234
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hp4w-jmwc-pg7w
Vendor Advisory
https://github.com/chamilo/chamilo-lms/commit/f2c382c94a3f153a4d7e5ce5686c5a219fd09b3b
Patch