A path traversal flaw in the Chamilo Learning Management System allows an attacker to delete any file that the web server’s PHP process can access. The vulnerability is triggered by user input that is appended to a filesystem path in the file main/exercise/savescores.php without any path validation. This flaw is classified as a Path Traversal (CWE‑22) and a Relative Path Traversal (CWE‑73) attack, giving the attacker control over which file is targeted for removal.

All deployments of Chamilo LMS earlier than version 1.11.38 are vulnerable. The affected code resides in the public‑facing script main/exercise/savescores.php. Users with any level of access to the web interface can potentially trigger the removal of critical course files or other system data if the server’s directory permissions grant write or delete rights.

The issue carries a high severity rating. Exploitation can be achieved remotely by sending crafted HTTP requests to the web interface, allowing the deletion of arbitrary files. Although no official exploitation probability score is available, the described path traversal makes the vulnerability readily exploitable. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the potential for widespread data loss warrants a high-priority response.