Chamilo LMS before version 1.11.34 suffers from a serious flaw that allows an authenticated low‑privileged user to upload arbitrary files based solely on MIME‑type verification. Because file extensions are not validated and the server does not enforce safe storage, the attacker can place a script or binary that the web server then executes, giving full control over the server. This is an example of Unrestricted File Upload (CWE‑434).

The affected product is Chamilo Learning Management System, versions earlier than 1.11.34. The vendor is Chamilo. Version 1.11.34 or newer contains the fix, so deployments using those releases are no longer vulnerable.

The CVSS score is 8.8, marking it as high severity. EPSS is below 1%, indicating a low current probability of exploitation. The flaw requires the attacker to be authenticated with low‑privilege permissions; typical attack paths involve uploading a malicious file through an unchecked upload endpoint and then triggering its execution via the web server. KEV status is not listed, meaning no known exploitation catalog entry exists.