EUVD-2026-46040Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint exploitable by any enrolled low-privilege user (PR:L) without interaction, yielding full RCE impact; the description shows no evidence of high attack complexity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by api_protect_course_script(true), which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it.
AnalysisAI
Remote code execution in Chamilo LMS 1.11.40 and earlier allows any user enrolled in a course to run arbitrary PHP through the main/inc/ajax/lang.ajax.php endpoint, which is guarded only by api_protect_course_script(true) and is therefore reachable by students, teachers, and DRH (HR) roles rather than administrators. The root cause is an improper-authorization defect (CWE-285) that exposes a dangerous language-editing endpoint to low-privilege course members. No public exploit code is identified at time of analysis and it is not listed in CISA KEV, but a vendor security advisory (GHSA-4hwq-pv7c-3928) has been published.
Technical ContextAI
Chamilo is a widely used open-source PHP-based learning management system (CPE cpe:2.3:a:chamilo:chamilo-lms). The vulnerable path main/inc/ajax/lang.ajax.php is an AJAX handler for managing and editing interface language strings. Chamilo persists language variables in writable PHP files, so an endpoint able to modify these strings can be leveraged to inject executable PHP, turning a translation-management feature into an arbitrary-code-execution primitive. The flaw falls under CWE-285 (Improper Authorization): the endpoint relies on api_protect_course_script(true), a coarse check that only confirms the caller is enrolled in a course context, instead of restricting this sensitive capability to administrators.
RemediationAI
Upgrade Chamilo LMS to the fixed release published in vendor advisory GHSA-4hwq-pv7c-3928 (https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4hwq-pv7c-3928); an exact fixed version number is not provided in the input data and should be taken directly from that advisory rather than assumed. As compensating controls until patched, restrict network access to the main/inc/ajax/lang.ajax.php endpoint at the web-server or reverse-proxy layer (deny or IP-allowlist it), accepting that this also breaks legitimate in-course language editing; disable open self-registration and require manual approval of course enrollment to shrink the pool of accounts that can reach the endpoint; and, where feasible, make the Chamilo language/config directories non-writable by the web server, accepting that this can interfere with in-app translation editing. Monitor access logs for POST requests to lang.ajax.php originating from non-admin accounts as a detection measure.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today