CVE-2026-30875

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30875", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-06T00:04:56.699Z", "datePublished": "2026-03-16T19:16:37.936Z", "dateUpdated": "2026-03-16T20:22:42.979Z"}, "containers": {"cna": {"title": "Chamilo LMS: Authenticated RCE via H5P Import", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm"}, {"name": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36", "tags": ["x_refsource_MISC"], "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36"}], "affected": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"version": "< 1.11.36", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-16T19:16:37.936Z"}, "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36."}], "source": {"advisory": "GHSA-mj4f-8fw2-hrfm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T20:16:34.379406Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:22:42.979Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T20:16:34.379406Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:20:32.838Z"}}], "cna": {"title": "Chamilo LMS: Authenticated RCE via H5P Import", "source": {"advisory": "GHSA-mj4f-8fw2-hrfm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "chamilo", "product": "chamilo-lms", "versions": [{"status": "affected", "version": "< 1.11.36"}]}], "references": [{"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm", "name": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36", "name": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-16T19:16:37.936Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30875", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:22:42.979Z", "dateReserved": "2026-03-06T00:04:56.699Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-16T19:16:37.936Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "chamilo-lms", "vendor": "chamilo", "versions": [{"status": "affected", "version": "< 1.11.36"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*", "matchCriteriaId": "87C4F8D8-CDE4-42B6-8661-0F7823DC1079", "versionEndExcluding": "1.11.36", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36."}, {"lang": "es", "value": "Chamilo LMS es un sistema de gesti\u00f3n del aprendizaje. Antes de la versi\u00f3n 1.11.36, una vulnerabilidad de carga arbitraria de archivos en la funci\u00f3n de importaci\u00f3n H5P permite a usuarios autenticados con rol de Profesor lograr Ejecuci\u00f3n Remota de C\u00f3digo (RCE). La validaci\u00f3n del paquete H5P solo verifica si h5p.json existe, pero no bloquea archivos .htaccess o PHP con extensiones alternativas. Un atacante carga un paquete H5P manipulado que contiene una webshell y .htaccess que habilita la ejecuci\u00f3n de PHP para archivos .txt, eludiendo el control de seguridad. Este problema ha sido parcheado en la versi\u00f3n 1.11.36."}], "id": "CVE-2026-30875", "lastModified": "2026-06-17T10:33:04.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30875", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:16:34.379406Z", "version": "2.0.3"}}]}, "published": "2026-03-16T20:16:18.330", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.36)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "chamilo-lms", "source": "cna", "vendor": "chamilo"}, "product": "chamilo_lms", "vendor": "chamilo"}], "analysis": {"en": {"generated_at": "2026-03-17T21:39:41.168830+00:00", "value": {"mitigation_remediation": ["Upgrade Chamilo LMS to version 1.11.36 or later \u2013 this is the official fix for the vulnerability.", "If an upgrade cannot be performed immediately, temporarily disable the H5P import functionality or remove it from the menu for Teacher users.", "Restrict the Walker of file uploads by allowing only the .h5p MIME type and rejecting files with .php, .htaccess, or alternative extensions.", "Configure the web server to disallow PHP execution in upload directories and remove .htaccess file handling for uploaded content."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the Chamilo Learning Management System from the vendor chamilo:chamilo-lms that are running any version earlier than 1.11.36 are affected. The impact spans the entire product line, and the CPE string cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:* captures the full range of impacted components.", "description_and_impact": "An authenticated user possessing the Teacher role in Chamilo LMS can upload a specially crafted H5P package via the import feature. The package includes a PHP webshell and an .htaccess file that changes PHP execution permissions for .txt files. Because the import logic only verifies the presence of h5p.json and does not validate file types or block potentially executable files, the web server executes the malicious code. This results in full remote code execution on the host, compromising confidentiality, integrity, and availability of the system. The weakness corresponds to CWE-94: Improper Control of Generation of Code through Dynamic Code Generation or Execution.", "risk_and_exploitability": "The CVSS score of 8.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not catalogued in CISA\u2019s KEV list. Exploitation requires an authenticated Teacher user who can access the H5P import feature; no known unauthenticated attack path exists. The attack vector is therefore authenticated, and the attacker must have appropriate role privileges to upload the malicious package."}}}}, "created": "2026-03-17T09:52:13.940746+00:00", "updated": "2026-03-24T10:49:53.708212+00:00", "vendors": ["chamilo", "chamilo$PRODUCT$chamilo_lms"]}