External risk intelligence

Chamilo LMS File Modification Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-33698

Chamilo LMS is a web-based learning management system typically deployed as a public-facing web application. While the vulnerability requires a specific deployment configuration (the presence of the install directory), the nature of the product as an internet-accessible educational platform places it in the category of commonly internet-facing web applications.

Chamilo Lms

before 1.11.38

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Chamilo Learning Management System could allow an unauthenticated attacker to modify or create files, impacting portals that still have an accessible installation directory. This issue is resolved in version 1.11.38.

Unauthenticated attackers can alter files on Chamilo LMS.
Affects learning platforms with accessible installation directories.
Confirm if your Chamilo LMS is affected and update it.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by chaining a series of actions to bypass security controls and execute unauthorized PHP code. This would allow them to modify or create files on the system, provided the installation directory is still accessible and the system has lenient file permissions. The vulnerability impacts Chamilo LMS instances that have not been updated and still retain their installation files.

No authentication or special access needed.
Triggered by chained PHP code execution.
Allows unauthenticated file modification.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could leverage a chained attack to execute PHP code from the main installation directory, potentially modifying or creating files on systems where the installation directory is still present and accessible. This could impact the integrity and availability of the learning management system.

System files and configurations are at risk.
Attackers can modify or create files.
Service availability and integrity may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Chamilo LMS, particularly instances with the `main/install/` directory accessible, requires immediate attention from application and infrastructure owners. The first step is to identify all deployed instances, confirm their business criticality and exposure, and then determine the accountable owner for remediation. Coordination with the vendor may be necessary to plan for applying the fix during an upcoming maintenance window.

Application owners are responsible for this issue.
Verify if `main/install/` directory is accessible.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chamilo LMS?

Chamilo LMS is an open-source learning management system designed for academic and corporate education. It serves as a web-based platform where administrators manage courses, instructors deliver content, and students interact with learning materials.

What does CVE-2026-33698 mean by file modification?

This CVE involves a vulnerability classified as CWE-552, or 'Files or Directories Accessible to External Parties.' It means an attacker can reach and use specific scripts intended for initial setup to execute unauthorized PHP code. This weakness allows them to bypass standard security and gain the ability to overwrite existing system files or inject new, malicious files onto the server hosting the learning platform.

How is this vulnerability triggered?

An attacker triggers this by interacting with the main/install/ directory to execute chained PHP commands. The vulnerability does not exist if this installation directory has been removed or properly restricted so that it is no longer readable by the web server. If that folder is absent or fully blocked, the attack path is effectively neutralized.

Is my Chamilo instance at risk?

According to Halo Surface Signal, Chamilo LMS is typically deployed as a public-facing application, making instances on the internet more likely to be reached by attackers. If your portal is reachable from the public web and retains the installation directory, it is a priority for review regardless of whether it is an internal training site or a public university portal.

How do I fix CVE-2026-33698?

The primary resolution is to upgrade your software to version 1.11.38 or later. As an immediate protective measure, check your web server directory structure to see if the main/install/ folder is still present. If it is, ensuring this directory is deleted or made inaccessible to web requests will help mitigate the risk while you schedule your formal software update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.