CVE-2026-33618: Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33618?
CVE-2026-33618 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-33618?
To fix CVE-2026-33618, upgrade Chamilo LMS to version 2.0.0-RC.3 or later.
Who is affected by CVE-2026-33618?
CVE-2026-33618 affects versions of Chamilo LMS prior to 2.0.0-RC.3, including alpha, beta, and release candidates.
What type of vulnerability is CVE-2026-33618?
CVE-2026-33618 is a remote code execution vulnerability originating from the use of PHP's eval() function.
Can an attacker exploit CVE-2026-33618 without admin access?
No, an attacker must have admin access to exploit CVE-2026-33618.