CVE-2026-29041: Chamilo LMS RCE Vulnerability

CVE-2026-29041 Overview

Chamilo LMS, a widely-used open-source learning management system, contains an authenticated remote code execution vulnerability in versions prior to 1.11.34. The vulnerability stems from improper validation of uploaded files, where the application relies solely on MIME-type verification without adequately validating file extensions or enforcing safe server-side storage restrictions. This flaw allows an authenticated low-privileged user to upload a crafted file containing executable code and subsequently execute arbitrary commands on the server.

Critical Impact

Authenticated attackers with low privileges can achieve full remote code execution on the server, potentially compromising the entire learning management system, student data, and connected infrastructure.

Affected Products

• Chamilo LMS versions prior to 1.11.34
• All installations allowing authenticated users to upload files
• Self-hosted Chamilo LMS deployments with default upload configurations

Discovery Timeline

• 2026-03-06 - CVE-2026-29041 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29041

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical web application security flaw. The core issue lies in the file upload handling mechanism within Chamilo LMS that fails to implement defense-in-depth validation.

When users upload files through the application, the system performs MIME-type verification but neglects to validate the actual file extension or implement proper server-side storage restrictions. An attacker can craft a malicious file—such as a PHP webshell—with a manipulated MIME-type header that passes the initial validation check. Once uploaded, if the file retains an executable extension and is stored in a web-accessible directory, the attacker can directly access the file to trigger code execution.

The network-accessible nature of this vulnerability combined with the low authentication requirements makes it particularly dangerous in educational environments where numerous users may have legitimate file upload privileges.

Root Cause

The root cause is an incomplete file upload validation strategy that relies exclusively on client-supplied MIME-type headers. MIME-type verification is easily bypassed by attackers who can craft requests with arbitrary Content-Type headers while uploading malicious payloads. The application lacks:

1. Server-side file extension validation against an allowlist
2. File content inspection (magic byte verification)
3. Secure storage configuration that prevents execution of uploaded files
4. Randomization of uploaded file names and paths

Attack Vector

The attack vector is network-based and requires only low-privilege authenticated access. An attacker can exploit this vulnerability through the following sequence:

1. Authenticate to the Chamilo LMS platform with any valid user account
2. Navigate to a file upload functionality within the application
3. Craft a malicious file containing executable code (e.g., PHP webshell)
4. Modify the upload request to include a legitimate MIME-type while retaining a dangerous file extension
5. Upload the crafted file to the server
6. Access the uploaded file directly via its URL to execute arbitrary commands

The vulnerability does not require user interaction beyond the initial authentication, making automated exploitation feasible once valid credentials are obtained.

Detection Methods for CVE-2026-29041

Indicators of Compromise

• Unusual file uploads with executable extensions (.php, .phtml, .php5, .phar) in upload directories
• Web server access logs showing direct requests to files in upload directories with query parameters indicative of webshell commands
• Unexpected outbound network connections originating from the web server process
• New or modified files in upload directories with recently created timestamps
• Process spawning from web server processes (e.g., www-data spawning shell commands)

Detection Strategies

• Monitor file upload directories for files with executable extensions using file integrity monitoring (FIM) solutions
• Implement web application firewall (WAF) rules to detect and block uploads of files with dangerous extensions regardless of MIME-type
• Analyze web server logs for patterns consistent with webshell access (POST requests to unusual file paths, command parameters)
• Deploy endpoint detection to identify web server processes spawning suspicious child processes

Monitoring Recommendations

• Enable detailed logging for all file upload operations including file names, extensions, and storage paths
• Configure alerts for any direct HTTP requests to files within upload directories
• Monitor for anomalous authentication patterns that may indicate credential compromise preceding exploitation
• Implement network traffic analysis to detect command-and-control communications from compromised servers

How to Mitigate CVE-2026-29041

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.34 or later immediately
• Audit upload directories for any suspicious files with executable extensions
• Review web server access logs for evidence of exploitation attempts
• Implement web server configuration to prevent execution of uploaded files
• Consider temporarily restricting file upload functionality until the patch is applied

Patch Information

Chamilo has addressed this vulnerability in version 1.11.34. Organizations should upgrade to this version or later to remediate the vulnerability. The patch implements proper file extension validation and secure storage handling for uploaded files.

For detailed information, refer to the GitHub Security Advisory GHSA-4pc3-4w2v-vwx8 and the GitHub Release v1.11.34.

Workarounds

• Configure the web server to deny execution of scripts in upload directories using appropriate directives (e.g., Apache php_flag engine off or nginx location blocks)
• Implement an allowlist of permitted file extensions at the web server or application firewall level
• Move upload directories outside the web root and serve files through a download script that sets appropriate headers
• Restrict file upload permissions to only trusted administrator accounts until the patch can be applied

# Apache configuration to prevent PHP execution in upload directories
<Directory "/var/www/chamilo/upload">
    php_flag engine off
    <FilesMatch "\.(php|phtml|php5|phar)$">
        Require all denied
    </FilesMatch>
</Directory>