CVE-2025-50187: Chamilo: Evaluation of untrusted user input leads to Remote Code Execution
Published Mar 2, 2026
·Updated
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
Affected Software
2 affected components
Chamilo Chamilo<1.11.28
Chamilo Chamilo LMS<1.11.28
Event History
Mar 2, 2026
CVE Published
via MITRE·02:37 PM
Data Sourced
via MITRE·02:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-50187?
CVE-2025-50187 is considered a critical vulnerability due to its potential for Remote Code Execution.
2
How do I fix CVE-2025-50187?
To resolve CVE-2025-50187, upgrade to Chamilo version 1.11.28 or later.
3
What are the potential impacts of CVE-2025-50187?
The exploitation of CVE-2025-50187 can lead to unauthorized execution of arbitrary code on the server.
4
Which versions of Chamilo are affected by CVE-2025-50187?
Versions of Chamilo prior to 1.11.28 are affected by CVE-2025-50187.
5
Is user input filtering implemented in the latest version of Chamilo?
Yes, the latest version addresses the vulnerability by properly filtering untrusted user input.