An authenticated user possessing the Teacher role in Chamilo LMS can upload a specially crafted H5P package via the import feature. The package includes a PHP webshell and an .htaccess file that changes PHP execution permissions for .txt files. Because the import logic only verifies the presence of h5p.json and does not validate file types or block potentially executable files, the web server executes the malicious code. This results in full remote code execution on the host, compromising confidentiality, integrity, and availability of the system. The weakness corresponds to CWE-94: Improper Control of Generation of Code through Dynamic Code Generation or Execution.

All installations of the Chamilo Learning Management System from the vendor chamilo:chamilo-lms that are running any version earlier than 1.11.36 are affected. The impact spans the entire product line, and the CPE string cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* captures the full range of impacted components.

The CVSS score of 8.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA’s KEV list. Exploitation requires an authenticated Teacher user who can access the H5P import feature; no known unauthenticated attack path exists. The attack vector is therefore authenticated, and the attacker must have appropriate role privileges to upload the malicious package.