Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-29041 EUVD-2026-9974

Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload

Published Mar 6, 2026 · Updated Mar 6, 2026 · Assigned by GitHub_M

Vendor: chamilo Product: chamilo-lms

Description

Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34.

Affected products

VendorProductAffectedFixed
chamilo chamilo-lms < 1.11.34 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • kx00007/CVE-2026-29041 ★ 2 · Mar 6, 2026

    Hi, I’m K, This is my first CVE, which is a Remote Code Execution (RCE) vulnerability. It is the beginning of my journey as a security researcher.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References