Description
Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.
Published: 2026-07-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Chamilo 1.11.40 and earlier allows any authenticated user enrolled in a course to run arbitrary PHP code via the lang.ajax.php endpoint. This endpoint is protected only by api_protect_course_script(true), providing no additional authorization checks, which aligns with CWE-285. Successful exploitation would give an attacker control over the server, compromising confidentiality, integrity, and availability of all data and services.

Affected Systems

The affected product is Chamilo Learning Management System version 1.11.40 and earlier. Administrators running these versions, whether on‑premises or hosted, need to verify their installation version and assess exposure.

Risk and Exploitability

With a CVSS score of 7.5, the vulnerability is considered high‑impact. The EPSS score is < 1%, and it is not currently listed in CISA KEV. Attackers need only authenticated access and course enrollment to reach the vulnerable endpoint, making the exploit likely in environments where users have such permissions.

Generated by OpenCVE AI on July 30, 2026 at 18:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest available security patch for Chamilo to address the authorization issue in lang.ajax.php.
  • If a patch cannot be applied immediately, block or disable the lang.ajax.php endpoint for non‑administrator users, or enforce strict role checks via a configuration change or web‑application firewall rule.
  • Conduct an audit of user enrollments and review logs for anomalous access to the lang.ajax.php path, ensuring that only privileged users have relevant API access.

Generated by OpenCVE AI on July 30, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Chamilo
Chamilo chamilo Lms
Vendors & Products Chamilo
Chamilo chamilo Lms

Mon, 20 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Description Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.
Title Chamilo Authenticated Remote Code Execution
Weaknesses CWE-285
References
Metrics cvssV4_0

{'score': 7.5, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Chamilo Chamilo Lms
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T18:24:41.863Z

Reserved: 2026-03-26T16:22:29.034Z

Link: CVE-2026-34239

cve-icon Vulnrichment

Updated: 2026-07-20T18:24:33.499Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T19:00:09Z

Weaknesses