CVE-2026-29041: 
Chamilo vulnerability analysis and mitigation

CVE-2026-29041 is an authenticated remote code execution (RCE) vulnerability in Chamilo LMS caused by unrestricted file upload (CWE-434). It affects Chamilo LMS versions up to and including 1.11.32, and was disclosed on March 5–6, 2026, with a patch released in version 1.11.34. The vulnerability allows an authenticated low-privileged user (e.g., a student) to upload a malicious PHP file and execute arbitrary commands on the server. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The vulnerability resides in the main/inc/ajax/document.ajax.php endpoint, specifically within the ck_uploadimage action, which is accessible to authenticated users including low-privileged roles such as enrolled students (GitHub Advisory). The root cause is that the application relies exclusively on PHP's mime_content_type() function for file validation, which can be trivially bypassed by prepending valid image magic bytes (e.g., GIF89a) to a PHP webshell payload — causing the MIME check to pass while the file retains a .php extension. When the $_configuration['enable_uploadimage_editor'] configuration option is enabled, the uploaded file is saved using its original filename (including the .php extension) in a web-accessible directory, allowing the attacker to directly request the file via browser and trigger server-side code execution. This is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (GitHub Advisory).

Successful exploitation results in complete system compromise, with high impact to confidentiality, integrity, and availability. An attacker can execute arbitrary OS commands as the web server process, exfiltrate sensitive data (including student records, credentials, and course content), modify or delete application content, and disrupt service availability. The attack requires only a valid low-privileged account (e.g., a student enrollment) and network access, with no user interaction needed, making it accessible to a broad range of threat actors (GitHub Advisory, Feedly).

A public proof-of-concept exploit repository exists at https://github.com/celeboy711-hue/CVE-2026-29041, indicating the vulnerability has been weaponized (Feedly). The EPSS score is approximately 0.206%, suggesting a relatively low but non-negligible probability of exploitation in the near term. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the available data. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Chamilo LMS instances running version 1.11.32 or earlier using tools like Shodan or Censys (search for Chamilo-specific HTTP headers or login pages). Confirm the enable_uploadimage_editor configuration is active by attempting to access the upload endpoint.
2. Obtain low-privileged credentials: Register or obtain credentials for any low-privileged account (e.g., a student enrolled in a course) on the target Chamilo instance.
3. Authenticate: Log in to the Chamilo LMS application and obtain a valid session cookie.
4. Craft malicious payload: Create a PHP webshell file with valid image magic bytes prepended to bypass MIME-type validation. For example, prepend GIF89a to a PHP payload such as <?php system($_GET['cmd']); ?> and save the file with a .php extension (e.g., shell.php).
5. Upload the malicious file: Send a crafted HTTP POST request to main/inc/ajax/document.ajax.php with the ck_uploadimage action, attaching the crafted file. The server's mime_content_type() check will pass due to the image magic bytes, and the file will be saved with its original .php extension in a web-accessible directory.
6. Execute arbitrary commands: Access the uploaded file directly via the browser (e.g., https://target/path/to/uploads/shell.php?cmd=id) to trigger server-side PHP execution and achieve remote code execution (GitHub Advisory).

• Network: Unusual HTTP POST requests to main/inc/ajax/document.ajax.php with the ck_uploadimage action parameter, especially from low-privileged user sessions; subsequent GET requests to uploaded .php files in document/upload directories from the same or different IP addresses.
• File System: Presence of .php files (or files with double extensions like .php.gif) in web-accessible upload directories (e.g., main/upload/, course document directories); files containing PHP code prefixed with image magic bytes such as GIF89a.
• Logs: Web server access logs showing POST requests to document.ajax.php followed by GET requests to newly created .php files in upload paths; PHP error logs showing execution of unexpected system commands.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, or python); unexpected outbound network connections from the web server host.

Upgrade Chamilo LMS to version 1.11.34 or later, which addresses this vulnerability (Chamilo Release). As interim mitigations, disable the enable_uploadimage_editor configuration option if not required, enforce strict file extension allowlisting (permitting only .jpg, .png, .gif, etc.), and configure the web server to deny execution of scripts in upload directories. Uploaded files should be stored outside the web root or served through a controlled handler rather than via direct URL access (GitHub Advisory).

The vulnerability was reported by security researcher Meng Hokseng and published as a GitHub Security Advisory by the Chamilo maintainer ywarnier on March 5, 2026 (GitHub Advisory). The Chamilo team characterized version 1.11.34 as "mostly a security release," underscoring the severity of the fix (Chamilo Release). The vulnerability was tracked by multiple threat intelligence platforms including ENISA's EUVD, Red Hat's CVE database, and VulnDB shortly after disclosure, reflecting broad community awareness.