CVE-2026-5546: Campcodes Learning System RCE Vulnerability

CVE-2026-5546 Overview

A critical unrestricted file upload vulnerability has been discovered in Campcodes Complete Online Learning Management System version 1.0. The vulnerability affects the add_lesson function within the file /application/models/Crud_model.php, allowing authenticated attackers to upload arbitrary files to the server. This flaw can be exploited remotely and enables potential remote code execution through malicious file uploads.

Critical Impact

Authenticated attackers can upload arbitrary files including web shells, potentially leading to full server compromise and unauthorized access to sensitive educational data.

Affected Products

• Campcodes Complete Online Learning Management System 1.0
• Systems utilizing the vulnerable Crud_model.php component
• Web servers hosting the affected OLMS application

Discovery Timeline

• 2026-04-05 - CVE-2026-5546 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5546

Vulnerability Analysis

The vulnerability exists in the add_lesson function of the Campcodes Complete Online Learning Management System. This function handles file uploads for lesson content but fails to implement proper validation controls on uploaded files. The lack of file type restrictions, extension validation, and content verification allows attackers with low-level privileges to upload malicious files to the web server.

The flaw is classified under CWE-284 (Improper Access Control), as the application does not properly restrict what types of files can be uploaded through the lesson creation functionality. Once a malicious file is uploaded, it can potentially be accessed directly through the web server, leading to remote code execution if the server processes the uploaded content.

Root Cause

The root cause of this vulnerability lies in the absence of proper file upload validation within the add_lesson function in /application/models/Crud_model.php. The application fails to:

1. Validate file extensions against an allowlist of permitted types
2. Verify file content matches the declared file type (MIME type validation)
3. Sanitize or rename uploaded files to prevent direct execution
4. Store uploaded files outside the web-accessible directory

This improper access control allows any file type to be uploaded and potentially executed on the server.

Attack Vector

The attack can be initiated remotely by any authenticated user with access to the lesson creation functionality. An attacker can craft a malicious request to the vulnerable endpoint, uploading a web shell or other malicious script disguised as legitimate lesson content.

The attack flow involves:

1. Authenticating to the OLMS application with valid credentials
2. Navigating to the lesson creation or upload functionality
3. Uploading a malicious PHP file (e.g., web shell) instead of legitimate content
4. Accessing the uploaded file directly via the web server to execute arbitrary commands

Technical details and proof-of-concept information are available in the GitHub CVE Repository and the VulDB Vulnerability Entry.

Detection Methods for CVE-2026-5546

Indicators of Compromise

• Unexpected PHP, JSP, or executable files in lesson upload directories
• Web shell signatures in uploaded content (e.g., eval(), system(), exec() functions)
• Unusual HTTP requests to non-standard file paths within the OLMS application
• Authentication logs showing access to lesson upload features followed by suspicious file access patterns

Detection Strategies

• Monitor file system changes in the OLMS upload directories for non-standard file extensions
• Implement web application firewall (WAF) rules to detect malicious file upload attempts
• Review HTTP POST requests to /application/models/Crud_model.php for suspicious payloads
• Deploy file integrity monitoring on the OLMS installation directory

Monitoring Recommendations

• Enable verbose logging on the web server for all file upload operations
• Configure SIEM alerts for new executable files appearing in web-accessible directories
• Monitor outbound connections from the web server that may indicate command-and-control activity
• Implement network traffic analysis to detect data exfiltration patterns

How to Mitigate CVE-2026-5546

Immediate Actions Required

• Restrict access to the lesson upload functionality to trusted administrators only
• Implement file extension allowlisting at the application and web server level
• Move the OLMS installation behind a VPN or internal network if possible
• Audit existing uploaded files for malicious content and remove any suspicious files

Patch Information

At the time of publication, no official patch has been released by Campcodes for this vulnerability. Organizations should monitor the CampCodes website for security updates and implement the workarounds described below until an official fix is available. Additional vulnerability details can be found in the VulDB submission.

Workarounds

• Configure the web server to deny execution of scripts in upload directories (e.g., disable PHP parsing)
• Implement a strict allowlist of permitted file extensions (e.g., only allow .pdf, .doc, .pptx)
• Add server-side MIME type validation to verify uploaded file content matches expected types
• Rename uploaded files to random strings and store original names in a database
• Store uploaded files outside the web root directory and serve them through a controlled download script

# Apache configuration to prevent script execution in upload directory
<Directory "/var/www/html/olms/uploads">
    php_admin_flag engine off
    AddHandler default-handler .php .phtml .php3 .php4 .php5
    Options -ExecCGI
    RemoveHandler .php .phtml .php3 .php4 .php5
</Directory>