CVE-2026-33698
Chamilo LMS affected by unauthenticated RCE in main/install folder
CVSS Score
0.0
EPSS Score
0.1%
EPSS Percentile
16th
Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38.
| CWE | CWE-552 |
| Vendor | chamilo |
| Product | chamilo-lms |
| Published | Apr 10, 2026 |
| Last Updated | Apr 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for chamilo chamilo-lms
Be the first to know when new unknown vulnerabilities affecting chamilo chamilo-lms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
chamilo / chamilo-lms
< 1.11.38