Chamilo LMS versions prior to 1.11.38 contain a chained attack that allows an unauthenticated attacker to execute PHP code located in the main/install directory, thereby enabling creation or modification of files where system permissions permit. The flaw is classified under CWE-552, indicating that it exploits an application component that was not meant to process user‑supplied code, resulting in arbitrary code execution on the web server.

All releases of Chamilo LMS older than 1.11.38 are affected, but only installations that still expose the main/install subdirectory to external users are vulnerable. Users should verify the presence of this directory and its read permissions before proceeding.

The CVSS base score of 9.3 signals critical severity, and while no EPSS score is published, the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only unauthenticated HTTP access to the exposed install folder; once an attacker delivers PHP code to that location, it runs with the web server’s privileges, potentially giving full administrative or system control.