CVE-2026-29041 Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload
Authenticated users can upload malicious files to execute arbitrary code on the server due to insufficient file validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-29041?
CVE-2026-29041 is a high-severity vulnerability in Chamilo Chamilo Lms, published on 6 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34.
Weakness: CWE-434
Which versions are affected by CVE-2026-29041?
It affects 1 product.
Products include Chamilo Chamilo Lms.
How do I fix CVE-2026-29041?
No fix has been published for CVE-2026-29041 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-29041 being exploited?
There is no known exploitation of CVE-2026-29041 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Chamilo Chamilo Lms
Sources
Also known as GHSA-4pc3-4w2v-vwx8.