What is the CVSS score of CVE-2026-30881?

CVE-2026-30881 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chamilo Lms are affected by CVE-2026-30881?

Chamilo LMS versions 1.11.34 and earlier contain a SQL injection vulnerability in the statistics module that allows authenticated users to extract or manipulate sensitive database information.. A patch is available.

How to fix or mitigate CVE-2026-30881?

Within 24 hours: inventory all Chamilo LMS deployments and identify instances running version 1.11.34 or earlier. Within 7 days: upgrade all vulnerable instances to Chamilo LMS 1.11.36 or later; test functionality in non-production environments first. Within 30 days: conduct database integrity audit and review access logs for the statistics AJAX endpoint (date_start and date_end parameters) for suspicious activity during the vulnerability window.

Chamilo Lms CVE-2026-30881

EUVD-2026-12500 HIGH

SQL Injection (CWE-89)

2026-03-16 GitHub_M

SQLi Chamilo Lms

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.36

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2026-12500

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 19:19 nvd

HIGH 8.8

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters date_start and date_end from $_REQUEST are embedded directly into a raw SQL string without proper sanitization. Although Database::escape_string() is called downstream, its output is immediately neutralized by str_replace("\'", "'", ...), which restores any injected single quotes - effectively bypassing the escaping mechanism entirely. This allows an authenticated attacker to inject arbitrary SQL statements into the database query, enabling blind time-based and conditional data extraction. This issue has been patched in version 1.11.36.

AnalysisAI

Authenticated attackers can exploit SQL injection in Chamilo LMS 1.11.34 and earlier through the statistics AJAX endpoint, where insufficient input sanitization allows bypassing of database escaping mechanisms via the date_start and date_end parameters. This vulnerability enables blind time-based SQL injection attacks to extract or manipulate sensitive data from the underlying database. Version 1.11.36 contains the patch; versions 1.11.35 and earlier remain vulnerable.

Technical ContextAI

Chamilo LMS is an open-source learning management system widely used in educational institutions. The vulnerability affects the statistics AJAX endpoint where date_start and date_end parameters from user requests are embedded directly into SQL queries. While the application attempts to sanitize input using Database::escape_string(), this protection is immediately undone by a subsequent str_replace("\'", "'", ...) call that restores any escaped single quotes. This is a classic example of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where proper input validation is implemented but then inadvertently bypassed. The affected product is identified by CPE cpe:2.3:a:chamilo:chamilo-lms:*:*:*:*:*:*:*:* for versions prior to 1.11.36.

RemediationAI

Upgrade Chamilo LMS to version 1.11.36 or later, which contains the official patch for this vulnerability as detailed in the release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36. If immediate patching is not possible, consider implementing web application firewall rules to filter SQL injection attempts in the date_start and date_end parameters of statistics endpoints, and restrict access to the statistics functionality to only trusted administrative users. Review the vendor security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-5ggx-x2cv-4h44 for additional guidance.