CVE-2018-25158: Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder

Published Feb 20, 2026

Updated

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

Affected Software

1 affected component

Chamilo Chamilo LMS

Event History

Feb 20, 2026

CVE Published

via MITRE·10:54 PM

Data Sourced

via MITRE·10:54 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2018-25158?

The severity of CVE-2018-25158 is considered to be high due to its potential to allow arbitrary file uploads and remote code execution by authenticated users.

How do I fix CVE-2018-25158?

To fix CVE-2018-25158, update your Chamilo LMS to the latest version that addresses this vulnerability.

Who is affected by CVE-2018-25158?

CVE-2018-25158 affects users of Chamilo LMS version 1.11.8 and potentially other versions with the elfinder filemanager module.

What type of vulnerability is CVE-2018-25158?

CVE-2018-25158 is an arbitrary file upload vulnerability that can lead to remote code execution.

Can untrusted users exploit CVE-2018-25158?

No, CVE-2018-25158 requires an authenticated user to exploit the vulnerability and upload malicious files.