Chamilo Learning Management System uses a file move function that directly places user‑controlled path values into system shell commands without proper sanitization. This allows authenticated users, specifically teachers who can freely move documents, to inject arbitrary commands. The vulnerability becomes active when a user creates a directory containing shell metacharacters—possible through the Course Backup Import feature—and then moves a document into that directory, causing the web server’s user process to execute unintended commands. The outcome is full control of the web server running the LMS, compromising confidentiality, integrity, and availability of the system and any data stored therein.

Chamilo LMS, provided by chamilo:chamilo-lms, affects versions prior to 1.11.38 and prior to 2.0.0‑RC.3. Users employing 1.11.36 or earlier are vulnerable; the fix is included in the releases 1.11.38 and 2.0.0‑RC.3. The vulnerability is tied to the move() function in fileManage.lib.php used by document.php.

The CVSS score of 9.1 indicates high severity. Exploitation requires only an authenticated teacher account and the ability to import a backup or otherwise create a directory name with shell metacharacters; no special conditions beyond those are stated. EPSS data is not available, but the absence from CISA’s KEV catalog does not negate the risk. The attack vector is local to the application but results in remote system compromise. Due to the straightforward exploitation path and elevated privileges required, the likelihood of an attacker successfully leveraging this flaw in an operational environment is considerable.