CVE-2026-32931 Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE
Authenticated teachers can upload PHP webshells via MIME spoofing in Chamilo LMS, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32931?
CVE-2026-32931 is a high-severity vulnerability in Chamilo Chamilo Lms, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Weakness: CWE-434
Which versions are affected by CVE-2026-32931?
It affects 1 product.
Products include Chamilo Chamilo Lms.
How do I fix CVE-2026-32931?
No fix has been published for CVE-2026-32931 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-32931 being exploited?
There is no known exploitation of CVE-2026-32931 in the wild and no public exploit code.
Other vulnerabilities in Chamilo Chamilo Lms
Sources
Also known as GHSA-863j-h6pf-3xhx.