CVE-2026-32931: 
Chamilo vulnerability analysis and mitigation

CVE-2026-32931 is an unrestricted file upload vulnerability (CWE-434) in Chamilo LMS's exercise sound upload function that allows an authenticated teacher to upload a PHP webshell and achieve Remote Code Execution (RCE). It affects all Chamilo LMS versions prior to 1.11.38 (1.x branch) and prior to 2.0.0-RC.3 (2.x branch, including RC1, RC2, and all alpha/beta releases). The vulnerability was published on April 10, 2026, and patches were released in the same timeframe. It carries a CVSS v3.1 base score of 8.8 (High) per NVD (GitHub Advisory, Feedly).

The root cause is in the Exercise::updateSound() method located in public/main/exercise/exercise.class.php (lines 1445–1475), which validates uploaded files solely by checking whether the client-supplied Content-Type header contains the string audio or video — a value entirely controlled by the attacker. No file extension check, magic bytes validation, or sanitization functions (e.g., disable_dangerous_file()) are applied, and the original attacker-controlled filename is used directly in move_uploaded_file(). An attacker crafts a multipart upload request with filename="shell.php" and Content-Type: audio/mpeg, causing the PHP file to be written to a web-accessible audio directory. Additionally, the unsanitized $sound['name'] value enables potential path traversal (e.g., ../../../evil.php) to write files outside the intended directory (GitHub Advisory, Patch Commit 1).

Successful exploitation grants an authenticated attacker (with teacher-level privileges) Remote Code Execution as the www-data web server user, enabling full compromise of the LMS host. Attackers can read sensitive files such as /etc/passwd, .env (containing database credentials), and configuration files, modify course content and student grades, and establish persistent webshell access. Exposed database credentials further enable lateral movement within the broader network infrastructure (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires authenticated access with teacher-level privileges, which somewhat limits the attack surface compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.177%, indicating a low (but non-negligible) probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain teacher credentials: Register or compromise a teacher account on the target Chamilo LMS instance (versions < 1.11.38 or < 2.0.0-RC.3).
2. Navigate to exercise sound upload: Log in and access the exercise management interface where the sound upload feature is available (e.g., via the exercise creation/editing form).
3. Craft malicious upload request: Prepare a PHP webshell file (e.g., shell.php) containing a payload such as <?php system($_GET['cmd']); ?>. Using a tool like Burp Suite or curl, craft a multipart HTTP POST request with:
   • Content-Disposition: form-data; name="sound"; filename="shell.php"
   • Content-Type: audio/mpeg (spoofed to bypass the MIME-only check)
4. Submit the upload: Send the crafted request to the exercise sound upload endpoint. The server's updateSound() method accepts the file because strstr('audio/mpeg', 'audio') evaluates to true, and moves shell.php to the web-accessible audio directory using the attacker-controlled filename.
5. Locate and trigger the webshell: Identify the web-accessible path of the uploaded file (typically under the course audio directory, e.g., /courses/<COURSE_ID>/document/audio/shell.php) and send an HTTP GET request such as https://target/courses/.../audio/shell.php?cmd=id to execute arbitrary OS commands as www-data.
6. Establish persistence: Use the webshell to download a reverse shell, exfiltrate .env credentials, or pivot to other systems (GitHub Advisory).

• Network: Unusual HTTP POST requests to exercise sound upload endpoints with Content-Type: audio/mpeg but a .php filename in the Content-Disposition header; subsequent GET requests to .php files within course audio/document directories from unexpected source IPs.
• File System: Presence of .php files in course audio directories (e.g., /courses/<COURSE_ID>/document/audio/*.php); unexpected files with webshell-like content (system(), exec(), passthru(), shell_exec()) in web-accessible upload directories.
• Logs: Web server access logs showing POST requests to exercise upload endpoints followed by GET requests to .php files in audio directories; error logs showing PHP execution from upload paths.
• Process: Unusual child processes spawned by the web server process (e.g., www-data running bash, curl, wget, python, or nc); unexpected outbound network connections from the web server process (GitHub Advisory).

Chamilo has addressed this vulnerability by removing the vulnerable updateSound() method entirely from exercise.class.php in both the 1.x and 2.x branches. Users should upgrade to Chamilo LMS 1.11.38 (1.x branch) or 2.0.0-RC.3 (2.x branch) immediately, applying patch commits 8cbe660 (1.x) and d5ef515 (2.x). As interim mitigations: configure the web server (Apache/Nginx) to deny PHP execution in upload directories; implement strict server-side file type validation using magic bytes rather than relying on client-supplied Content-Type headers; and restrict teacher-level account creation to trusted individuals. Monitor upload directories for unexpected .php files (GitHub Advisory, Patch Commit 1, Patch Commit 2).

The vulnerability was reported by researcher ik0z and published via GitHub's security advisory system on April 10, 2026. A brief mention appeared on Mastodon via @thehackerwire shortly after disclosure. No significant vendor statements beyond the GitHub advisory or major media coverage have been identified at this time (GitHub Advisory).