The vulnerability originates from multiple eval() calls in the vendored PEAR HTML_QuickForm library. These calls execute arbitrary PHP code when a form element name matches attacker‑controlled input. Because standard Chamilo forms use static element names, exploitation normally requires a developer‑specific plugin or a misconfiguration that allows user input to influence those names. If the conditional path is reachable, the attacker can run any PHP code on the server, resulting in full compromise of the hosting system.

The flaw affects the Chamilo Learning Management System (Chamilo LMS). Versions in the 1.x line older than 1.11.40 and versions in the 2.x line older than 2.0.1 are vulnerable. All systems running those pre‑patched releases are at risk.

The CVSS score of 6.6 indicates a moderate severity with potential for significant impact. No EPSS data is published and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation reports yet. The attack vector requires the attacker to create form element names that the Chamilo instance will interpret, typically through a plugin or misconfiguration. If such a conditional path exists, the attacker can achieve remote code execution with no additional privileges.