Chamilo LMS CVE-2026-44344

Exploitation requires a non-default code path in which user-controlled input reaches a QuickForm element name - specifically a developer-written plugin or a misconfiguration, since standard Chamilo forms use hardcoded element names and are therefore NOT exploitable. The vulnerable sinks are the eval() calls in the vendored PEAR HTML_QuickForm libraries (element.php _findValue/_prepareValue and file.php _findValue). Limiting factors: default/standard installations are not exploitable without such a custom path; the vulnerable path is attacker-uncontrolled (hence the high attack complexity); and reaching the affected forms generally requires authenticated access. Fully remediated only by updating to 1.11.40 or 2.0.1, which replace the eval()-based array construction with safe preg_split parsing.

This is a conditional, environment-dependent RCE that should be treated as moderate priority rather than an emergency. The input CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, score 6.6) already encodes the two biggest dampeners: AC:H reflects that exploitation depends on an attacker-uncontrolled precondition (a developer-written plugin or misconfiguration that routes user input into QuickForm element names), and PR:H indicates privileged access is needed. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the dampened risk. No EPSS score, no CISA KEV listing, and no exploit/PoC code were provided - the only references are the GHSA advisory, three remediation commits, and the two fixed release tags, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a high technical impact (full server compromise where the vulnerable path exists) is gated behind a code path that the vendor explicitly states does not occur in standard Chamilo forms, which use hardcoded element names. The practical takeaway: critical impact but low likelihood on default deployments; real risk concentrates in sites running custom/third-party plugins that pass user input to form element names.

On a Chamilo site whose developer has written a custom plugin (or misconfiguration) that lets user-supplied data become a QuickForm element name, an attacker who can reach that form submits a crafted element name that is interpolated into one of the vendored PEAR HTML_QuickForm eval() calls, executing arbitrary PHP as the web server and compromising the host. Against a default Chamilo install this does not work because form element names are hardcoded, and no public exploit code is available. Attack complexity is high (AC:H) precisely because the vulnerable code path is non-default and attacker-uncontrolled.