What is the CVSS score of CVE-2026-33704?

CVE-2026-33704 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-33704?

Chamilo LMS versions before 1.11.38 contain a remote code execution vulnerability that allows authenticated users, including students, to upload malicious PHP files and execute arbitrary code on the…. A patch is available.

How to fix or mitigate CVE-2026-33704?

Within 24 hours: Identify all Chamilo LMS instances and their current versions; disable the BigUpload endpoint if version is prior to 1.11.38 until patching is complete. Within 7 days: Apply vendor-released patch to Chamilo 1.11.38 or later on all affected instances; verify patch deployment. Within 30 days: Conduct access logs review for suspicious file uploads to the BigUpload endpoint; implement file upload restrictions at the web server layer to block .pht and other executable extensions.

PHP CVE-2026-33704

EUVD-2026-21555 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-10 security-advisories@github.com

Apache PHP File Upload RCE

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38

EUVD ID Assigned

Apr 10, 2026 - 19:22 euvd

EUVD-2026-21555

Analysis Generated

Apr 10, 2026 - 19:22 vuln.today

CVE Published

Apr 10, 2026 - 19:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via the BigUpload endpoint. The key parameter controls the filename and the raw POST body becomes the file content. While .php extensions are filtered to .phps, the .pht extension passes through unmodified. On Apache configurations where .pht is handled as PHP, this leads to Remote Code Execution. This vulnerability is fixed in 1.11.38.

AnalysisAI

Remote code execution in Chamilo LMS versions prior to 1.11.38 allows authenticated users (including low-privilege students) to upload and execute arbitrary PHP code through the BigUpload endpoint. Attackers exploit insufficient file extension filtering by uploading .pht files containing malicious code, which Apache servers with default .pht handlers execute as PHP. The vulnerability enables authenticated attackers to achieve full server compromise through unrestricted arbitrary file write capabilities. No public exploit identified at time of analysis.

Technical ContextAI

CWE-434 unrestricted file upload stems from incomplete extension blacklist in BigUpload endpoint. While .php extensions are rewritten to .phps, the .pht extension bypasses filtering despite Apache mod_php treating .pht as executable PHP by default. The key parameter directly controls destination filename without proper sanitization, and raw POST body becomes file content without validation.

RemediationAI

Vendor-released patch: upgrade to Chamilo LMS version 1.11.38 immediately. The fix implements comprehensive file extension validation preventing .pht and other executable extension uploads. See upstream commit 9748f1ffbdb8b6dc84c0e0591c9d3c1d92e21c00 and vendor advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-phfx-pwwg-945v for technical details. Temporary workaround: configure Apache to explicitly deny execution of .pht files via AddType directive or disable .pht handler in mod_mime configuration, though upgrading remains the authoritative solution. Review existing uploads directory for suspicious .pht files and audit user-uploaded content for webshells. Restrict BigUpload endpoint access at network perimeter for untrusted user populations if immediate patching is infeasible.