CVE-2026-33704: Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint
Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33704?
CVE-2026-33704 has a high severity rating due to the potential for authenticated users to write arbitrary files on the server.
How do I fix CVE-2026-33704?
To mitigate the risk of CVE-2026-33704, upgrade Chamilo LMS to version 1.11.38 or later.
Who is affected by CVE-2026-33704?
All authenticated users, including students, on affected versions of Chamilo LMS are vulnerable to CVE-2026-33704.
What is the impact of CVE-2026-33704?
CVE-2026-33704 allows attackers to upload arbitrary content or files, which can compromise the server and its data.
What are the affected versions in CVE-2026-33704?
CVE-2026-33704 affects Chamilo LMS versions prior to 1.11.38.