Which versions of PHP are affected by CVE-2026-33698?

Chamilo LMS versions before 1.11.38 contain a critical arbitrary file write vulnerability allowing unauthenticated attackers to modify or create files with system-level permissions through an…. A patch is available.

How to fix or mitigate CVE-2026-33698?

Within 24 hours: Verify that main/install/ directory has been deleted from all Chamilo deployments; if present, remove immediately and confirm deletion via file system audit. Within 7 days: Upgrade all Chamilo LMS instances to version 1.11.38 or later per vendor advisory; test thoroughly in staging before production deployment. Within 30 days: Conduct file integrity audit on all affected systems to detect unauthorized modifications; review access logs for exploitation attempts; implement monitoring to alert on any recreation of main/install/ directory.

PHP CVE-2026-33698

Q: What is the CVSS score of CVE-2026-33698?

CVE-2026-33698 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21539 CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-04-10 GitHub_M

PHP Information Disclosure Path Traversal

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38

EUVD ID Assigned

Apr 10, 2026 - 18:45 euvd

EUVD-2026-21539

Analysis Generated

Apr 10, 2026 - 18:45 vuln.today

CVE Published

Apr 10, 2026 - 18:14 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38.

AnalysisAI

Arbitrary file write vulnerability in Chamilo LMS versions before 1.11.38 allows unauthenticated remote attackers to modify existing files or create new files with system-level permissions through a chained attack exploiting the main/install/ directory. Attackers can bypass PHP execution restrictions when the installation directory remains accessible post-deployment, enabling complete system compromise where filesystem permissions permit. This vulnerability affects portals that have not removed the main/install/ directory after initial setup. No public exploit identified at time of analysis.

Technical ContextAI

CWE-552 (Files or Directories Accessible to External Parties) chain enables PHP code execution from the installation directory. Vulnerability permits file manipulation operations beyond intended access controls by leveraging residual install components. Attack vector requires network access to unremoved main/install/ directory with read permissions.

RemediationAI

Vendor-released patch: version 1.11.38. Upgrade immediately to Chamilo LMS 1.11.38 or later via official channels. Apply commit d3355d7873c7e5b907c5fa84cbd5d9b62ed33e51 if building from source. Critical interim workaround: immediately remove or restrict access to the main/install/ directory on all production systems through filesystem permissions (chmod 000) or web server configuration (deny directives in .htaccess/nginx.conf). Verify the installation directory is inaccessible externally before patching. Advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-557g-2w66-gpmf. Post-upgrade, audit filesystem for unauthorized files created during exposure window and review web server access logs for exploitation attempts targeting /main/install/ paths.