CVE-2026-29041

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29041", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T17:50:11.242Z", "datePublished": "2026-03-06T03:32:37.563Z", "dateUpdated": "2026-03-06T16:09:09.242Z"}, "containers": {"cna": {"title": "Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8"}, {"name": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34", "tags": ["x_refsource_MISC"], "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34"}], "affected": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"version": "< 1.11.34", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T03:32:37.563Z"}, "descriptions": [{"lang": "en", "value": "Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34."}], "source": {"advisory": "GHSA-4pc3-4w2v-vwx8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:58:24.091319Z", "id": "CVE-2026-29041", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:09:09.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-29041", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T15:58:24.091319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:58:25.147Z"}}], "cna": {"title": "Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload", "source": {"advisory": "GHSA-4pc3-4w2v-vwx8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 1.11.34"}]}], "references": [{"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8", "name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34", "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T03:32:37.563Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29041", "state": "PUBLISHED", "dateUpdated": "2026-03-06T16:09:09.242Z", "dateReserved": "2026-03-03T17:50:11.242Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T03:32:37.563Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "chamilo-lms", "vendor": "chamilo", "versions": [{"status": "affected", "version": "< 1.11.34"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF6714C4-3D58-43BF-A32C-6D436DB93E01", "versionEndExcluding": "1.11.34", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34."}, {"lang": "es", "value": "Chamilo es un sistema de gesti\u00f3n del aprendizaje. Antes de la versi\u00f3n 1.11.34, Chamilo LMS est\u00e1 afectado por una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo autenticada causada por una validaci\u00f3n incorrecta de los archivos subidos. La aplicaci\u00f3n se basa \u00fanicamente en la verificaci\u00f3n del tipo MIME al manejar las subidas de archivos y no valida adecuadamente las extensiones de archivo ni aplica restricciones seguras de almacenamiento en el servidor. Como resultado, un usuario autenticado con bajos privilegios puede subir un archivo manipulado que contiene c\u00f3digo ejecutable y posteriormente ejecutar comandos arbitrarios en el servidor. Este problema ha sido parcheado en la versi\u00f3n 1.11.34."}], "id": "CVE-2026-29041", "lastModified": "2026-06-17T10:29:29.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29041", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:58:24.091319Z", "version": "2.0.3"}}]}, "published": "2026-03-06T04:16:08.553", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.34)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "chamilo-lms", "source": "cna", "vendor": "chamilo"}, "product": "chamilo_lms", "vendor": "chamilo"}], "analysis": {"en": {"generated_at": "2026-04-16T11:42:17.538063+00:00", "value": {"mitigation_remediation": ["Upgrade Chamilo LMS to version 1.11.34 or later to eliminate the vulnerability.", "Restrict uploaded file types on the server side and enforce strict validation of both MIME type and file extension before processing.", "Disable or restrict the file upload feature for low\u2011privileged users, or move uploaded files to a directory inaccessible to the web server."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is Chamilo Learning Management System, versions earlier than 1.11.34. The vendor is Chamilo. Version 1.11.34 or newer contains the fix, so deployments using those releases are no longer vulnerable.", "description_and_impact": "Chamilo LMS before version 1.11.34 suffers from a serious flaw that allows an authenticated low\u2011privileged user to upload arbitrary files based solely on MIME\u2011type verification. Because file extensions are not validated and the server does not enforce safe storage, the attacker can place a script or binary that the web server then executes, giving full control over the server. This is an example of Unrestricted File Upload (CWE\u2011434).", "risk_and_exploitability": "The CVSS score is 8.8, marking it as high severity. EPSS is below 1%, indicating a low current probability of exploitation. The flaw requires the attacker to be authenticated with low\u2011privilege permissions; typical attack paths involve uploading a malicious file through an unchecked upload endpoint and then triggering its execution via the web server. KEV status is not listed, meaning no known exploitation catalog entry exists."}}}}, "created": "2026-03-06T14:56:01.574136+00:00", "updated": "2026-04-16T11:45:26.269874+00:00", "vendors": ["chamilo", "chamilo$PRODUCT$chamilo_lms"]}