CVE-2025-50196 - Vulnerability Analysis
HighCVSS: 7.2Last Updated: March 3, 2026
Chamilo - Command Injection
Published: March 2, 2026Updated: March 3, 2026PoC AvailableRemote Exploitable
Overview
Chamilo < 1.11.30 contains a command injection caused by unsanitized POST main_database parameter in /plugin/vchamilo/views/editinstance.php, letting attackers execute arbitrary OS commands remotely, exploit requires crafted POST request.
Severity & Score
Severity: High
CVSS Score: 7.2
Impact
Attackers can execute arbitrary OS commands remotely, potentially leading to full system compromise.
Mitigation
Update to version 1.11.30 or later.
References
- https://github.com/chamilo/chamilo-lms/commit/afdbd4bb9a9ea17b7740559dd4e05aa13b16480d
- https://github.com/chamilo/chamilo-lms/commit/e343c764493b457c82d1e85b91a3655b093767ed
- https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30
- https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-qfvp-xg47-m7m2
Related Resources
Details
- CVE ID
- CVE-2025-50196
- Severity
- High
- CVSS Score
- 7.2
- Type
- command_injection
- Status
- confirmed
CWE
- CWE-78
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H