Chamilo LMS, an open‑source learning management system, contains a flaw in the PlatformConfigurationController::decodeSettingArray() method, where PHP's eval() is used to parse platform settings stored in the database. An attacker with administrative access can inject arbitrary PHP code into these settings. When any user, even unauthenticated, invokes the /platform-config/list endpoint, the injected code is executed on the server. This allows full code execution on the host and is classified as a Remote Code Execution vulnerability based on CWE‑95.

All releases of Chamilo LMS up to, but not including, 2.0.0‑RC.3 are vulnerable. The flaw exists in the core PlatformConfigurationController component of the Chamilo LMS product. The fix was introduced in version 2.0.0‑RC.3. Administrators of installations older than this version should evaluate the need for an upgrade.

The CVSS score of 8.8 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because injection requires administrative privileges, an attacker must first compromise or gain admin access—an event that may be facilitated by other weaknesses such as weak passwords. Once code is injected, its execution is triggered by any request to /platform-config/list, which is reachable by unauthenticated users, increasing the attack surface. Consequently, the risk remains high until a patch is applied.