Chamilo Learning Management System allows any authenticated user to write an arbitrary file through the BigUpload endpoint. The key parameter controls the filename, and the entire POST body becomes the file content. While the system normally changes .php extensions to .phps, the .pht extension is not filtered and passes through unchanged. On web server configurations where .pht files are executed as PHP, an attacker can embed malicious code, gaining full remote code execution on the host. The weakness corresponds to improper validation of uploaded file names and types.

All installations of Chamilo LMS running versions earlier than 1.11.38 are affected. Any user who can authenticate—students, teachers, or administrators—has the ability to upload and overwrite files, so the vulnerability is present across the entire user base of these versions.

The CVSS score of 7.1 indicates a high level of severity, though the EPSS score is not available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authentication to the LMS and an Apache configuration that executes .pht files as PHP; once those conditions are met, execution of arbitrary code is possible. Given the lack of an automated exploit, exploit likelihood is uncertain, but the potential impact of remote code execution makes the risk significant.