CVE-2026-33698: Chamilo LMS affected by unauthenticated RCE in main/install folder

Q: What is the severity of CVE-2026-33698?

CVE-2026-33698 is classified as a critical severity vulnerability due to its potential for unauthenticated remote code execution.

Q: How do I fix CVE-2026-33698?

To fix CVE-2026-33698, upgrade Chamilo LMS to version 1.11.38 or a later version.

Q: What type of vulnerability is CVE-2026-33698?

CVE-2026-33698 is an unauthenticated remote code execution vulnerability that affects the Chamilo LMS.

Q: Which systems are affected by CVE-2026-33698?

CVE-2026-33698 affects all versions of Chamilo LMS prior to 1.11.38.

Q: Can an attacker exploit CVE-2026-33698 without authentication?

Yes, an attacker can exploit CVE-2026-33698 without authentication, allowing malicious actions to be performed on the server.

Published Apr 10, 2026

Updated

Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38.

Affected Software

2 affected components

Chamilo Chamilo LMS<1.11.38

Remediation

Patch Available

https://github.com/chamilo/chamilo-lms/commit/d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51

Event History

Apr 10, 2026

CVE Published

via MITRE·06:14 PM

Data Sourced

via MITRE·06:14 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-33698?

CVE-2026-33698 is classified as a critical severity vulnerability due to its potential for unauthenticated remote code execution.

How do I fix CVE-2026-33698?