CVE-2026-30875 - Vulnerability Analysis

Overview

Chamilo LMS < 1.11.36 contains an arbitrary file upload vulnerability in the H5P Import feature caused by insufficient validation of uploaded package files, letting authenticated Teacher users achieve remote code execution by uploading crafted packages with webshell and .htaccess files.

Severity & Score

Impact

Authenticated Teacher users can execute arbitrary code remotely, potentially compromising the entire system.

Mitigation

Update to version 1.11.36 or later.

References

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-30875 - High (8.8) Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30875/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner