CVE-2026-32892
Full vulnerability record from the local CVENow database.
Description
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-10 18:16:41.797000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-32892",
"sourceIdentifier": "[email protected]",
"published": "2026-04-10T18:16:41.797",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec(\"mv $source $target\"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3."
},
{
"lang": "es",
"value": "Chamilo LMS es un sistema de gestión del aprendizaje. Antes de 1.11.38 y 2.0.0-RC.3, Chamilo LMS contiene una vulnerabilidad de inyección de comandos del sistema operativo en la función de mover archivos. La función move() en fileManage.lib.php pasa valores de ruta controlados por el usuario directamente a comandos de shell exec() sin usar escapeshellarg(). Cuando un usuario mueve un documento a través de document.php, el parámetro POST move_to - que solo pasa por Security::remove_XSS() (un filtro solo de HTML) - se concatena directamente en comandos de shell como exec(’mv $source $target’). Por defecto, Chamilo permite a todos los usuarios autenticados crear cursos (allow_users_to_create_courses = true). Cualquier usuario que sea profesor en un curso (incluidos los cursos autocreados) puede mover documentos, haciendo que esta vulnerabilidad sea explotable por cualquier usuario autenticado. El atacante debe primero colocar un directorio con metacaracteres de shell en su nombre en el sistema de archivos (lograble a través de la importación de copia de seguridad del curso), luego mover un documento a ese directorio para desencadenar la ejecución arbitraria de comandos como el usuario del servidor web (www-data). Esta vulnerabilidad está corregida en 1.11.38 y 2.0.0-RC.3."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "chamilo",
"product": "chamilo-lms",
"versions": [
{
"version": "< 1.11.38",
"status": "affected"
},
{
"version": ">= 2.0.0-alpha.1, < 2.0.0-RC.3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T14:07:07.082335Z",
"id": "CVE-2026-32892",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11.38",
"matchCriteriaId": "A4D0C5D2-6FA0-4532-8E3D-4EA111A50621"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha1:*:*:*:*:*:*",
"matchCriteriaId": "4AF7661F-C1F7-4CAB-BBDF-FC5BF7F5BEB8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha2:*:*:*:*:*:*",
"matchCriteriaId": "FE56AF71-9D53-42C6-980D-09E1C418ED87"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha3:*:*:*:*:*:*",
"matchCriteriaId": "01195674-9E1A-4C07-B7D3-0F0CC2E6511B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha4:*:*:*:*:*:*",
"matchCriteriaId": "BAE63449-5A56-4302-A4BF-F3D19FC96A80"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:alpha5:*:*:*:*:*:*",
"matchCriteriaId": "A84A06F9-5AB7-4703-8153-33AC68882B95"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "B91302A3-53DE-4ED0-BAAB-FE9DA03F8242"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "46008D4A-96F7-4E04-8256-E115AAAE3383"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "6E2BCAFF-D44B-4E67-998A-DF855E27606B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D2E7D018-E4C2-45F5-8D9A-DAC947173607"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:chamilo:chamilo_lms:2.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "DAF96697-6B6D-459D-9510-E5CEEDC2859B"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/chamilo/chamilo-lms/commit/3597b19b73d73d681e4fb503285e9bbfe71714bf",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/chamilo/chamilo-lms/commit/62671e5e268f235cddfba704edee90f35c234df1",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-59cv-qh65-vvrr",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}