https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33737.htmlhttps://patchthecve.com/cve/CVE-2026-33737.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.3: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.https://patchthecve.com/cve/CVE-2026-33736.htmlhttps://patchthecve.com/cve/CVE-2026-33736.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, phone, roles) via GET /api/users, including administrator accounts. This vulnerability is fixed in 2.0.0-RC.3.https://patchthecve.com/cve/CVE-2026-33710.htmlhttps://patchthecve.com/cve/CVE-2026-33710.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). https://patchthecve.com/cve/CVE-2026-33708.htmlhttps://patchthecve.com/cve/CVE-2026-33708.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, active status) of any user to any authenticated user, including students. There is no authorization check. This vulnerhttps://patchthecve.com/cve/CVE-2026-33707.htmlhttps://patchthecve.com/cve/CVE-2026-33707.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.4: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's email can compute the reset token and change the victimhttps://patchthecve.com/cve/CVE-2026-33706.htmlhttps://patchthecve.com/cve/CVE-2026-33706.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.1: Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via the update_user_from_username endpoint. A student (status=5) can change their status to Teacher/CourseManager (status=1), gaining course creation and managehttps://patchthecve.com/cve/CVE-2026-33705.htmlhttps://patchthecve.com/cve/CVE-2026-33705.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.3: Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structuhttps://patchthecve.com/cve/CVE-2026-33704.htmlhttps://patchthecve.com/cve/CVE-2026-33704.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.1: Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are https://patchthecve.com/cve/CVE-2026-33703.htmlhttps://patchthecve.com/cve/CVE-2026-33703.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 6.5: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId paramhttps://patchthecve.com/cve/CVE-2026-33702.htmlhttps://patchthecve.com/cve/CVE-2026-33702.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.1: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning Path progress saving endpoint. The file lp_ajax_save_item.php accepts a uid (user ID) parameter directly from $_REQUEST and useshttps://patchthecve.com/cve/CVE-2026-33698.htmlhttps://patchthecve.com/cve/CVE-2026-33698.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.8: Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals withttps://patchthecve.com/cve/CVE-2026-33618.htmlhttps://patchthecve.com/cve/CVE-2026-33618.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.8: Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings,https://patchthecve.com/cve/CVE-2026-33141.htmlhttps://patchthecve.com/cve/CVE-2026-33141.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 6.5: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any authenticated user (including low-privilege students with ROLE_USER) to read any other user's learning progress, certificates, and gradhttps://patchthecve.com/cve/CVE-2026-32932.htmlhttps://patchthecve.com/cve/CVE-2026-32932.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 4.7: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks the ihttps://patchthecve.com/cve/CVE-2026-32931.htmlhttps://patchthecve.com/cve/CVE-2026-32931.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.5: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its orighttps://patchthecve.com/cve/CVE-2026-32930.htmlhttps://patchthecve.com/cve/CVE-2026-32930.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.1: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluation edit page allows any authenticated teacher to view and modify the settings (name, max score, weight) of evaluations belonging to any othehttps://patchthecve.com/cve/CVE-2026-32894.htmlhttps://patchthecve.com/cve/CVE-2026-32894.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.1: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result view page allows any authenticated teacher to delete any student's grade result across the entire platform by manipulating the delete_mark orhttps://patchthecve.com/cve/CVE-2026-32893.htmlhttps://patchthecve.com/cve/CVE-2026-32893.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, a Reflected Cross-Site Scripting (XSS) vulnerability in the exercise question list admin panel allows an attacker to execute arbitrary JavaScript in an authenticated teacher's browser. The pagination code merges all $_GET parameters vhttps://patchthecve.com/cve/CVE-2026-32892.htmlhttps://patchthecve.com/cve/CVE-2026-32892.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.1: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshehttps://patchthecve.com/cve/CVE-2026-31941.htmlhttps://patchthecve.com/cve/CVE-2026-31941.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.7: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via the social_wall_new_msg_main POST parameter and perfhttps://patchthecve.com/cve/CVE-2026-31940.htmlhttps://patchthecve.com/cve/CVE-2026-31940.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.5: Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.https://patchthecve.com/cve/CVE-2026-31939.htmlhttps://patchthecve.com/cve/CVE-2026-31939.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 8.3: Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit