CVE-2026-32892 - Vulnerability Analysis

Overview

Chamilo LMS < 1.11.38 and < 2.0.0-RC.3 contains an OS command injection caused by unsanitized user input in move() function in fileManage.lib.php, letting authenticated teacher users execute arbitrary commands as web server user, exploit requires attacker to create a directory with shell metacharacters.

Severity & Score

Impact

Authenticated teacher users can execute arbitrary OS commands as the web server user, potentially leading to full server compromise.

Mitigation

Upgrade to versions 1.11.38 or 2.0.0-RC.3 or later.

References

• https://github.com/chamilo/chamilo-lms/commit/3597b19b73d73d681e4fb503285e9bbfe71714bf
• https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-59cv-qh65-vvrr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner