CVE-2025-50197: Chamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameter
Published Mar 2, 2026
·Updated
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sublanguageajax.inc.php via the POST newlanguage parameter. This issue has been patched in version 1.11.30.
Affected Software
2 affected components
Chamilo Chamilo<1.11.30
Chamilo Chamilo LMS<1.11.30
Remediation
Event History
Mar 2, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
DescriptionWeakness
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-50197?
CVE-2025-50197 is classified as a critical vulnerability due to its potential for OS Command Injection.
2
How do I fix CVE-2025-50197?
To remediate CVE-2025-50197, upgrade Chamilo to version 1.11.30 or later.
3
What is affected by CVE-2025-50197?
CVE-2025-50197 affects Chamilo versions prior to 1.11.30.
4
What are the implications of exploiting CVE-2025-50197?
Exploiting CVE-2025-50197 can allow attackers to execute arbitrary OS commands on the server.
5
How does CVE-2025-50197 work?
CVE-2025-50197 occurs due to insufficient input validation of the POST new_language parameter in the /main/admin/sub_language_ajax.inc.php file.