CVE-2026-30875 Details
Description
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.
A remote code execution vulnerability has been identified in Chamilo LMS versions prior to 1.11.36. This issue arises from an arbitrary file upload flaw in the H5P Import feature, which allows authenticated users with Teacher roles to execute malicious code. The vulnerability exists because the H5P package validation process only verifies the presence of the 'h5p.json' file and fails to restrict the upload of '.htaccess' or PHP files with alternative extensions. Exploitation involves uploading a manipulated H5P package that includes a web shell and an '.htaccess' file configured to permit PHP execution for '.txt' files, thereby circumventing existing security measures.
Users can upgrade to Chamilo LMS version 1.11.36 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 | [email protected] | ProductRelease Notes |
| https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chamilo chamilo lms | < 1.11.36 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 16, 2026 | New CVE Received | [email protected] |