What is the CVSS score of CVE-2026-30875?

CVE-2026-30875 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-30875?

Chamilo LMS versions prior to 1.11.36 contain an arbitrary file upload vulnerability that allows authenticated teachers to execute remote code by uploading malicious H5P packages with embedded…. A patch is available.

How to fix or mitigate CVE-2026-30875?

Within 24 hours: Identify all Chamilo LMS deployments and document current versions. Within 7 days: Upgrade all instances to Chamilo 1.11.36 or later; restrict H5P upload functionality to administrator-only access as interim measure if upgrade cannot be completed. Within 30 days: Conduct audit of H5P packages uploaded since deployment to identify suspicious files; review web server logs for webshell access patterns; verify file permissions on H5P directories restrict script execution.

PHP CVE-2026-30875

EUVD-2026-12496 HIGH

Code Injection (CWE-94)

2026-03-16 GitHub_M

PHP RCE File Upload Code Injection Chamilo Lms

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.36

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2026-12496

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 19:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.

AnalysisAI

An arbitrary file upload vulnerability in Chamilo LMS allows authenticated users with Teacher role to achieve Remote Code Execution by uploading malicious H5P packages. The flaw affects versions prior to 1.11.36 and stems from inadequate validation of H5P package contents, which only checks for h5p.json existence but fails to block .htaccess or PHP files with alternative extensions. With a CVSS score of 8.8 and high exploitation potential, attackers can upload webshells disguised as text files along with .htaccess configurations to bypass security controls.

Technical ContextAI

Chamilo LMS is an open-source learning management system identified by CPE cpe:2.3:a:chamilo:chamilo-lms. The vulnerability exists in the H5P (HTML5 Package) import functionality, which is designed to allow educators to upload interactive educational content. The root cause aligns with CWE-94 (Improper Control of Generation of Code), where insufficient input validation allows malicious code injection through file uploads. The system's validation mechanism only verifies the presence of h5p.json in uploaded packages but fails to inspect or restrict other potentially dangerous files like .htaccess or PHP scripts with non-standard extensions, enabling attackers to circumvent typical file upload restrictions.

RemediationAI

Upgrade Chamilo LMS to version 1.11.36 or later, which includes patches for this vulnerability as documented in the release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36. Until patching is possible, consider temporarily disabling the H5P import functionality for Teacher-level accounts or implementing strict file upload monitoring and web application firewall rules to detect and block uploads containing .htaccess files or suspicious file extensions. Review all previously uploaded H5P packages for potential backdoors and monitor Teacher account activities for unusual file upload patterns.