CVE-2026-33698: Chamilo LMS RCE Vulnerability

CVE-2026-33698 Overview

CVE-2026-33698 is a critical vulnerability in Chamilo LMS, an open-source learning management system. This flaw enables a chained attack that bypasses restrictions on PHP code within the main/install/ directory, allowing unauthenticated attackers to modify existing files or create new files where system permissions allow. The vulnerability specifically affects Chamilo LMS installations where the main/install/ directory remains present and is read-accessible after the initial platform setup.

Critical Impact

Unauthenticated remote attackers can leverage this vulnerability to write arbitrary files to the server, potentially leading to remote code execution, data theft, or complete system compromise on vulnerable Chamilo LMS installations.

Affected Products

• Chamilo LMS versions prior to 1.11.38
• Chamilo LMS installations with the main/install/ directory present and accessible
• All Chamilo LMS deployments that have not removed the installation directory post-setup

Discovery Timeline

• 2026-04-10 - CVE-2026-33698 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-33698

Vulnerability Analysis

This vulnerability is classified under CWE-552 (Files or Directories Accessible to External Parties), indicating improper access restrictions on sensitive installation files. The attack chain exploits the presence of the main/install/ directory, which should be removed after Chamilo LMS installation but often remains on production systems.

The vulnerability enables unauthenticated attackers to execute otherwise-blocked PHP code from within the installation directory. By chaining multiple requests, an attacker can bypass security controls that would normally prevent direct execution of installation scripts, ultimately gaining the ability to create or modify files on the target system.

Root Cause

The root cause of CVE-2026-33698 lies in insufficient access controls for the main/install/ directory after the initial Chamilo LMS setup process. The installation directory contains PHP scripts that retain elevated privileges for system configuration tasks. When this directory remains accessible post-installation, attackers can exploit the chained attack vector to re-enable blocked functionality and abuse file manipulation capabilities that were intended only for the installation phase.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability remotely against any Chamilo LMS instance where:

1. The main/install/ directory is present on the server
2. The directory is readable via web requests
3. System file permissions allow write operations in target locations

The chained attack methodology involves multiple sequential requests that bypass protections designed to disable installation functionality. Once these protections are circumvented, the attacker gains arbitrary file write capabilities bounded only by the web server's filesystem permissions.

The vulnerability mechanism involves bypassing PHP code execution restrictions within the installation directory. When the main/install/ directory remains accessible after deployment, attackers can craft a series of HTTP requests that re-enable blocked installation scripts. These scripts retain privileged file system operations that, when exploited, allow writing arbitrary content to the server. For complete technical details, refer to the GitHub Security Advisory GHSA-557g-2w66-gpmf.

Detection Methods for CVE-2026-33698

Indicators of Compromise

• Unexpected HTTP requests to /main/install/ directory paths in web server access logs
• New or modified PHP files appearing in web-accessible directories outside normal application updates
• Unusual file creation timestamps indicating potential exploitation activity
• Web shell artifacts or backdoor files in Chamilo LMS directories

Detection Strategies

• Monitor web server logs for requests targeting the main/install/ directory pattern
• Implement file integrity monitoring (FIM) on critical Chamilo LMS directories
• Deploy web application firewall (WAF) rules to block requests to /main/install/ paths
• Configure intrusion detection systems to alert on suspicious PHP file creation events

Monitoring Recommendations

• Enable detailed access logging for the Chamilo LMS document root
• Set up alerts for any HTTP 200 responses to requests containing /install/ in the URI path
• Implement real-time file system monitoring for new .php file creation in web directories
• Review server logs regularly for patterns indicating reconnaissance or exploitation attempts

How to Mitigate CVE-2026-33698

Immediate Actions Required

• Upgrade Chamilo LMS to version 1.11.38 or later immediately
• Remove or rename the main/install/ directory on all Chamilo LMS installations
• Verify that the installation directory is not accessible via web requests
• Audit existing files for unauthorized modifications or suspicious additions

Patch Information

Chamilo has addressed this vulnerability in version 1.11.38. The fix is available via the official commit d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51. Organizations should prioritize upgrading to the patched version. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-557g-2w66-gpmf.

Workarounds

• Remove the main/install/ directory entirely from production deployments
• Block access to the installation directory at the web server level using deny rules
• Implement strict file system permissions to prevent the web server from writing to sensitive directories
• Deploy a web application firewall with rules targeting installation directory access patterns

# Configuration example - Block access to install directory in Apache
<Directory "/var/www/chamilo/main/install">
    Require all denied
</Directory>

# Or remove the directory entirely (recommended)
rm -rf /var/www/chamilo/main/install/

# For Nginx - block install directory access
location ~ /main/install/ {
    deny all;
    return 403;
}