Ce mail provient de l'extérieur, restons vigilants ==================================================================== CERT-Renater Note d'Information No. 2026/VULN731 _____________________________________________________________________ DATE : 07/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Chamilo LMS (PHP), chamilo-lms (Composer) versions prior to 2.0.3, 1.11.40, chamilo-lms (Composer) versions prior to. ==================================================================== https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-97gp-5f3j-vwqr https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-gcjp-f7jm-rrrg https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-853c-q5q4-jm2c https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qqwp-55vx-w4gp https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-39qq-f7xc-9w6q https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-7fhg-337c-qvf7 https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-wjxh-pvwh-h84p https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4hwq-pv7c-3928 https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-xfhv-qg8r-rc7w _____________________________________________________________________ ZIP Slip / Path Traversal in CourseRestorer leads to arbitrary file write and RCE by any course teacher (< 2.0.3, < 1.11.40) Critical ywarnier published GHSA-97gp-5f3j-vwqr Package Chamilo LMS (PHP) Affected versions <= 2.0.2 Patched versions 2.0.3, 1.11.40 Description Summary CourseRestorer writes files extracted from a user-supplied legacy course backup ZIP without confining the destination to the extraction directory. Any course teacher (the standard instructor role — no admin required) can upload a crafted ZIP whose entry names contain .. segments and cause file_put_contents() to write attacker-controlled bytes to arbitrary paths on the webserver filesystem. This yields remote code execution as the PHP-FPM user, e.g. by dropping a PHP webshell under public/ or by overwriting Symfony compiled cache files under var/cache// that are auto-loaded on the next request. Confirmed by static analysis against tag 2.0.2. Impact Vulnerability class: Path traversal / ZIP slip (CWE-22) leading to arbitrary file write (CWE-73) and, via PHP-executable write locations, remote code injection (CWE-94). Who is impacted: Every Chamilo LMS deployment that allows non-administrator users to import course backups — i.e. essentially all default deployments, since the "import course" feature is part of the standard teacher toolkit and is gated only by api_is_allowed_to_edit(). Attacker prerequisites: A single teacher account on the target portal. No admin role, no chained vulnerability, no victim interaction beyond the attacker uploading their own crafted backup. Worst case: Full remote code execution as the PHP-FPM user, leading to total compromise of the Chamilo host: read/modify all course content and grades across the platform, dump the entire user database (PII, password hashes), pivot to other services on the host, and persist via cron / webshell. Scope: Changed — a course-scoped, low-privilege capability escalates to the security authority of the entire portal/host. Workarounds for operators pending a patch Restrict the "Import course backup" feature to platform administrators only, e.g. by removing the capability from non-admin roles or by webserver-level ACLs on /main/course_copy/ and the corresponding API endpoints under CourseMaintenanceController. Audit var/cache/, public/main/plugin/, and the document storage root for unexpected files written by recent backup imports. Ensure the PHP-FPM user does not have write access to public/ outside the documented uploads directory; this removes the easiest RCE primitive but does not stop the var/cache/ primitive. Credits Reporter: Nguyen Manh Thuan (manhthuan.2902@gmail.com) Discovery date: 2026-05-20 Disclosure: Coordinated with Chamilo maintainers Severity Critical 9.0/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVE ID No known CVE Weaknesses Weakness CWE-22 Weakness CWE-73 Weakness CWE-94 Credits @ManhThuan ManhThuan Reporter _____________________________________________________________________ Stored XSS via user registration leads to admin account takeover (< 1.11.40) Critical ywarnier published GHSA-gcjp-f7jm-rrrg Package chamilo/chamilo-lms (Composer) Affected versions <= 1.11.38 Patched versions 1.11.40 Description Summary A stored cross-site scripting vulnerability in the user registration form allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. Impact An unauthenticated attacker can achieve full platform administrator access. The only requirement is that self-registration is enabled — a common configuration for educational LMS deployments. Once the XSS fires (triggered by any admin visiting the user list as part of routine administration), the attacker gains: Full administrative control of the platform Access to all user data, grades, and course content Ability to create, modify, or delete any accounts and courses Potential for further server compromise through admin functionality Affected Code File Lines Issue main/auth/inscription.php 453 Security::remove_XSS() (HTMLPurifier) does not escape " in non-HTML text; null byte insertion bypasses event handler detection main/admin/user_list.php 472-475 First/last name placed in alt/title attributes without htmlspecialchars() Suggested Remediation Replace lines 472-475 in main/admin/user_list.php: $personName = htmlspecialchars( api_get_person_name($user[2], $user[3]), ENT_QUOTES, 'UTF-8' ); $photo = ''.$personName.''; Additionally, strip null bytes from user input before passing to HTMLPurifier, and audit all locations where user-supplied data is placed inside HTML attributes to ensure htmlspecialchars() with ENT_QUOTES is consistently applied. Credit Discovered by Louis Sanchez (Voke Cyber) Severity Critical 9.3/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed Confidentiality High Integrity High Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVE ID CVE-2026-39878 Weaknesses Weakness CWE-79 Credits @louissanchez-vokecyber louissanchez-vokecyber Finder _____________________________________________________________________ Authenticated RCE through .htaccess in dropbox (< 1.11.40) High ywarnier published GHSA-853c-q5q4-jm2c Package Chamilo LMS (PHP) Affected versions <= 1.11.38 Patched versions 1.11.40 Description Summary The course dropbox upload handler in Chamilo LMS 1.11.38 (main/dropbox/dropbox_functions.inc.php, reachable via main/inc/ajax/dropbox.ajax.php?a=upload_file) accepts a literal .htaccess filename and stores it unchanged inside the course dropbox directory. Because the dropbox directory is served directly by Apache through the root rewrite catch-all (and Chamilo requires AllowOverride All), an attacker-supplied .htaccess is applied by Apache. Any course participant (student) can chain a .htaccess upload with a second upload of a PHP payload disguised as a .gif, producing Remote Code Execution as the web-server user on a default Chamilo installation — no extra configuration required. Impact Vulnerability class: Unrestricted Upload of File with Dangerous Type + External Control of File Name (CWE-434, CWE-73) leading to Remote Code Execution. Required privileges: any authenticated user enrolled in a course (student) with the dropbox tool enabled (default). Affected version: Chamilo LMS 1.11.38 (default configuration, no special settings). Consequence: Remote Code Execution as the web-server user (typically www-data). Full read/write of the Chamilo installation, all course content, database credentials in app/config/configuration.php, and persistent backdoor placement. Chains with the pre-authentication SQLi in [[ADVISORY_V10]] (extract credentials → log in as student → RCE) or with the unauthenticated administrator-takeover in [[ADVISORY_V14]] (admin enrols an attacker account, then uploads) to become an effective pre-auth RCE. Status in later versions Chamilo 1.11.36 (VULNERABLE) chamilo-1.11.36/main/dropbox/dropbox_functions.inc.php contains the same store_add_dropbox() implementation: $dropbox_filename = php2phps($dropbox_filename); (no htaccess2txt()), the same cb_overwrite branch that skips the uniqid rename when no matching sentWork entry exists, and the same move_uploaded_file() sink. The default upload_extensions_blacklist value and the root-.htaccess catch-all are likewise unchanged. The four-weakness chain reproduces verbatim. Chamilo 2.0.0 (NOT APPLICABLE) The legacy dropbox tool has been removed in 2.0.0. chamilo-2.0.0/public/main/dropbox/ and chamilo-2.0.0/public/main/inc/ajax/dropbox.ajax.php do not exist; uploads in 2.0.0 use the Symfony ResourceNode / ResourceFile model. The specific store_add_dropbox() primitive described above is gone. Author Sean MATTHEWS Severity High CVE ID No known CVE Weaknesses No CWEs _____________________________________________________________________ Stores XSS in update_users (< 1.11.40) High ywarnier published GHSA-qqwp-55vx-w4gp Package Chamilo LMS (PHP) Affected versions <= 1.11.38 Patched versions 1.11.40 Description Summary The update_users action of the AJAX endpoint main/inc/ajax/user_manager.ajax.php in Chamilo LMS 1.11.38 — already known to allow unauthenticated email rewrites in [[ADVISORY_V14]] — also accepts attacker-controlled values for the firstname, lastname, and email fields and persists them verbatim into the user table. These fields are then rendered without HTML escaping on multiple high-traffic pages (user_portal.php, the admin user listing, user information, social profile, course participant list, message-composer recipient header), giving an unauthenticated attacker stored Cross-Site Scripting against every user who views the injected account — including the platform administrator. Impact Vulnerability class: Stored Cross-Site Scripting via Broken Access Control on the storage endpoint (CWE-79, CWE-862). Required privileges: none (pre-auth / unauthenticated). Affected version: Chamilo LMS 1.11.38. Consequence: An unauthenticated attacker persists arbitrary JavaScript into any user's profile fields. The payload executes in the browser session of every user who views any page that lists or shows the injected account, including administrators. Chained with [[ADVISORY_V14]] this gives the attacker both a loud takeover primitive (email change → password reset) and a silent persistent foothold (XSS fires for every viewer of the modified account). When the injected target is the platform administrator (default user_id=1), the payload is rendered to every logged-in user via user_portal.php, enabling cookie theft, in-session admin actions, or platform-wide malware delivery. Status in later versions Chamilo 1.11.36 (VULNERABLE) The update_users branch of main/inc/ajax/user_manager.ajax.php is byte-identical between 1.11.36 and 1.11.38 (diff of lines 460-540 is empty). All confirmed render sinks (user_portal.php, main/admin/user_list.php, main/admin/user_information.php, main/social/profile.php, main/user/user.php, main/messages/new_message.php) exist at the same paths in 1.11.36, and user_portal.php is byte-identical to the 1.11.38 version. The chain reproduces verbatim. Chamilo 2.0.0 (NOT APPLICABLE) The update_users action no longer exists in chamilo-2.0.0/public/main/inc/ajax/user_manager.ajax.php — grep for case 'update_users' returns no match. The legacy injection endpoint is gone (consistent with [[ADVISORY_V14]]'s 2.0.0 status). Author Sean MATTHEWS Severity High CVE ID No known CVE Weaknesses No CWEs _____________________________________________________________________ Authenticated arbitrary files deletion i, cleandeletedfiles plugin (< 1.11.40) High ywarnier published GHSA-39qq-f7xc-9w6q Package Chamilo LMS (PHP) Affected versions < 1.11.38 Patched versions 1.11.40 Description Summary The cleandeletedfiles plugin shipped with Chamilo LMS 1.11.36 exposes an AJAX endpoint (plugin/cleandeletedfiles/src/ajax.php) that passes a user-controlled path/list parameter directly to unlink() with no validation. An authenticated administrator (or any user abusing CSRF against an admin) can delete arbitrary files writable by the web server. Impact Vulnerability class: Arbitrary File Delete (Path Traversal / Unvalidated Input to unlink()). Required privileges: authenticated administrator (or CSRF against an admin session). Affected version: Chamilo LMS 1.11.36 with the cleandeletedfiles plugin enabled. Consequence: Deletion of arbitrary files writable by the web server, including application sources, uploaded content, cache, and configuration — leading to data loss and denial of service. Status in later versions Chamilo 1.11.38 (VULNERABLE) chamilo-1.11.38/plugin/cleandeletedfiles/src/ajax.php is byte-identical to version 1.11.36. It is only gated by api_protect_admin_script() and still calls unlink($_REQUEST['path']) / unlink($value) for items from $_REQUEST['list'] with no canonicalization or base-directory restriction. The Arbitrary File Delete primitive for an authenticated admin remains. Chamilo 2.0.0 (VULNERABLE) chamilo-2.0.0/chamilo/public/plugin/cleandeletedfiles/src/ajax.php is identical to the 1.11.36 handler. Same delete-file / delete-files-list branches calling unlink() on raw $_REQUEST['path'] / $_REQUEST['list'], only protected by api_protect_admin_script(). Author Mathieu Farrell Severity High CVE ID No known CVE Weaknesses No CWEs _____________________________________________________________________ XXE Injection Vulnerability in BigBlueButton Plugin (<=2.0.2) High ywarnier published GHSA-7fhg-337c-qvf7 Package chamilo/chamilo-lms (Composer) Affected versions >= 2.0.0 Patched versions 2.0.3 Description Summary An XML External Entity (XXE) injection vulnerability exists in the BigBlueButton plugin of Chamilo LMS. The vulnerability allows authenticated administrators to read arbitrary files from the server and perform Server-Side Request Forgery (SSRF) attacks by configuring a malicious BigBlueButton server URL. Impact Confidentiality Impact: HIGH Read arbitrary files from the server (configuration files, source code, credentials) Access sensitive data such as /etc/passwd, /var/www/html/.env, database credentials Potential exposure of API keys, secrets, and internal system information Severity High 8.2/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Changed Confidentiality High Integrity Low Availability Low CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L CVE ID No known CVE Weaknesses Weakness CWE-611 Credits @pentestttvk1011 pentestttvk1011 Reporter _____________________________________________________________________ IDOR in lp_ajax_save_objectives.php — Attacker Can Overwrite Any User's SCORM Objectives via uid Parameter (CWE-639) (< 1.11.40, < 2.0.1) High ywarnier published GHSA-wjxh-pvwh-h84p Package Chamilo LMS (PHP) Affected versions <= 2.0.0 Patched versions 1.11.40, 2.0.1 Description VULNERABILITY REPORT — Chamilo LMS TARGET App: Chamilo LMS Repo: https://github.com/chamilo/chamilo-lms Version: 2.1.0 (latest) CWE: CWE-639 — Authorization Bypass Through User-Controlled Key CVSS: 7.1 HIGH (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) SUMMARY Any logged-in student can overwrite another student's SCORM learning objectives by changing the "uid" parameter in a request. No ownership check is performed. NOTE: CVE-2026-33702 patched lp_ajax_save_item.php for this exact pattern. The SAME bug exists in lp_ajax_save_objectives.php — which was NOT patched. FIX Replace $_REQUEST['uid'] with api_get_user_id() in all 3 files. This is the same fix applied to lp_ajax_save_item.php for CVE-2026-33702. CONTACT Santhoshini Ganta Email: [santhoshinive75@gmail.com] LinkedIn: (http://linkedin.com/in/santhoshini-g-1440621ba) Severity High CVE ID CVE-2026-45142 Weaknesses Weakness CWE-639 Credits @santhoshinipayload santhoshinipayload Reporter _____________________________________________________________________ Authenticated Remote Code Execution (< 1.11.40) High ywarnier published GHSA-4hwq-pv7c-3928 Package No package listed Affected versions <=1.11.40 Patched versions 1.11.40 Description The vulnerable path: main/inc/ajax/lang.ajax.php — translate_portfolio_category Access control: This endpoint is protected only by api_protect_course_script(true) (line 9), which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it. There is no admin check. Severity High 7.5/ 10 CVSS v4 base metrics Exploitability Metrics Attack Vector Network Attack Complexity High Attack Requirements None Privileges Required High User interaction None Vulnerable System Impact Metrics Confidentiality High Integrity High Availability High Subsequent System Impact Metrics Confidentiality None Integrity None Availability None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE ID CVE-2026-34239 Weaknesses No CWEs Credits @ywarnier ywarnier Reporter _____________________________________________________________________ Stored XSS in Learning Path TOC via malicious SCORM package item title (< 2.0.3, < 1.11.40) Moderate ywarnier published GHSA-xfhv-qg8r-rc7w Package chamilo/chamilo-lms (Composer) Affected versions <= 2.0.2, <= 1.11.38 Patched versions 2.0.3, 1.11.40 Description Vulnerability Details File (source — import time): public/main/lp/scormItem.class.php Line: 61 File (store): public/main/lp/scorm.class.php Lines: 343–368 File (render sink): src/CoreBundle/Resources/views/LearnPath/scorm_list.html.twig Lines: 1, 69, 83, 159, 170 CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Root Cause When a Teacher uploads a SCORM package, scormItem::parse_children() reads the element from imsmanifest.xml via $child->firstChild->nodeValue with no XSS sanitization (line 61). The value passes through api_utf8_decode() (encoding conversion only) in scorm.class.php and is stored directly in c_lp_item.title via CLpItem::setTitle(). The scorm_list.html.twig template begins with {% autoescape false %} and renders the title as {{ item.title | raw }} — explicitly disabling Twig's auto-escaping. A secondary code path in getListArrayToc() (learnpath.class.php line 2790) applies strip_tags() + Security::remove_XSS() only when the optional AI disclosure feature is enabled. When AI disclosure is disabled (the default production state), no sanitization occurs. Impact Auth required to trigger: Yes (Teacher role to import SCORM package) Auth required to be affected: Yes (enrolled students viewing the LP) Consequence: session hijacking of enrolled students; if admin views the LP, admin session is compromised Verification Confirmed on Chamilo LMS v2.1.0 (PHP 8.2 / MariaDB / Apache / Docker) on 2026-05-29. SCORM zip uploaded via POST /main/lp/lp_controller.php?action=upload. Payload stored raw in c_lp_item.title. LP TOC rendered via /main/lp/lp_controller.php?action=view&lp_id=1 with AI disclosure disabled confirmed: Line 150: <span class="lp-item-title"><img src=x onerror=alert(document.cookie)>XSS-VULN-002</span> Severity Moderate CVE ID CVE-2026-55503 Weaknesses No CWEs Credits @alanturing881 alanturing881 Reporter ======================================================== + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + ========================================================