CVE-2026-34239: Chamilo LMS Authenticated RCE Vulnerability

CVE-2026-34239 Overview

CVE-2026-34239 is an authenticated remote code execution vulnerability affecting Chamilo LMS version 1.11.40 and earlier. The flaw resides in the main/inc/ajax/lang.ajax.php endpoint, which relies solely on api_protect_course_script(true) for access control. This weak authorization check permits any authenticated user enrolled in a course, including students, teachers, and DRH accounts, to reach the vulnerable code path. Successful exploitation grants attackers arbitrary code execution on the underlying web server. The issue is tracked under CWE-285: Improper Authorization.

Critical Impact
Any low-privileged authenticated Chamilo user can execute arbitrary code on the server, leading to full application compromise and potential lateral movement.

Affected Products

Chamilo LMS 1.11.40
Chamilo LMS versions prior to 1.11.40
Deployments exposing main/inc/ajax/lang.ajax.php to enrolled course users

Discovery Timeline

2026-07-20 - CVE-2026-34239 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-34239

Vulnerability Analysis

The vulnerability affects the language management AJAX endpoint in Chamilo LMS. The endpoint is intended for administrative language configuration but is gated only by api_protect_course_script(true). This function verifies that the caller is enrolled in a course rather than validating administrative privileges. As a result, the authorization model conflates enrollment with elevated permissions on server-side language files.

Because Chamilo course enrollment can include students, teachers, and human resources managers (DRH), the attack surface is far broader than the intended administrator-only scope. The endpoint's downstream logic writes attacker-controlled data into PHP files consumed by the language subsystem, enabling code execution when those files are loaded.

Root Cause

The root cause is improper authorization [CWE-285]. api_protect_course_script(true) does not enforce a role check appropriate for language file modification. The application assumes the endpoint is safe for any course-enrolled principal, but the underlying operation persists user-supplied strings into executable PHP contexts.

Attack Vector

An attacker first obtains valid credentials for any account enrolled in at least one course. The attacker then issues crafted POST requests to main/inc/ajax/lang.ajax.php containing payloads that are written into language files. When the server subsequently includes those files, the injected PHP is executed under the web server's identity. See the Chamilo GitHub Security Advisory GHSA-4hwq-pv7c-3928 for technical details.

Detection Methods for CVE-2026-34239

Indicators of Compromise

Unexpected POST requests to main/inc/ajax/lang.ajax.php originating from non-administrator accounts
Modifications to files under the Chamilo language directories (main/lang/) with unusual PHP constructs or non-translation content
New or altered .php files in language subdirectories with recent timestamps not aligned with maintenance windows
Web shell artifacts or outbound connections initiated by the PHP-FPM or Apache worker process hosting Chamilo

Detection Strategies

Review web server access logs for authenticated requests to lang.ajax.php and correlate with the requesting user role
Deploy file integrity monitoring on the Chamilo main/lang/ directory tree to alert on unauthorized changes
Inspect PHP files under language directories for syntax patterns typical of injected payloads such as eval, system, passthru, or base64_decode

Monitoring Recommendations

Enable verbose application logging for AJAX endpoints and forward logs to a central SIEM for correlation
Alert on process creation by the web server user spawning shells, curl, wget, or interpreters
Monitor egress traffic from the Chamilo host for connections to unknown external endpoints

How to Mitigate CVE-2026-34239

Immediate Actions Required

Upgrade Chamilo LMS to a version released after 1.11.40 that addresses the authorization flaw
Restrict network access to main/inc/ajax/lang.ajax.php at the reverse proxy or WAF layer until patched
Audit existing user accounts and revoke stale enrollments to reduce the pool of accounts that can reach the endpoint
Review language directory contents for injected code and restore from known-good backups if tampering is found

Patch Information

Refer to the Chamilo GitHub Security Advisory GHSA-4hwq-pv7c-3928 for the vendor's fixed release and remediation guidance. The upstream fix strengthens the authorization check on the affected endpoint so that only privileged administrators can invoke language file operations.

Workarounds

Block requests to main/inc/ajax/lang.ajax.php at the WAF or web server configuration for all non-administrator sessions
Set the Chamilo language directory to read-only for the web server user where operationally feasible
Temporarily disable self-registration and audit accounts with active course enrollments

bash

# Example nginx snippet restricting access to the vulnerable endpoint
location = /main/inc/ajax/lang.ajax.php {
    allow 10.0.0.0/8;       # administrative network only
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}