What is the CVSS score of EUVD-2026-21524?

EUVD-2026-21524 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2026-21524?

Chamilo LMS versions 1.x before 1.11.38 and 2.0.0-RC before RC.3 contain a critical OS command injection vulnerability that allows authenticated teacher-role users to execute arbitrary system…. A patch is available.

How to fix or mitigate EUVD-2026-21524?

Within 24 hours: Identify all Chamilo LMS deployments and their current versions by checking fileManage.lib.php and admin panel version display; audit access logs for suspicious move() function calls with special characters in parameters. Within 7 days: Upgrade Chamilo 1.x to version 1.11.38 or later, and upgrade Chamilo 2.0.0-RC to RC.3 or later per vendor release notes; restrict teacher role creation to trusted personnel only and audit existing teacher accounts. Within 30 days: Implement input validation and output encoding in any custom Chamilo extensions; conduct full security review of course backup/import functionality and file handling procedures.

PHP EUVD-2026-21524

| CVE-2026-32892 CRITICAL

OS Command Injection (CWE-78)

2026-04-10 security-advisories@github.com

PHP Command Injection

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 21:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.11.38,2.0.0-RC.3

EUVD ID Assigned

Apr 10, 2026 - 18:22 euvd

EUVD-2026-21524

Analysis Generated

Apr 10, 2026 - 18:22 vuln.today

CVE Published

Apr 10, 2026 - 18:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter - which only passes through Security::remove_XSS() (an HTML-only filter) - is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitrary command execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

AnalysisAI

OS command injection in Chamilo LMS 1.x (prior to 1.11.38) and 2.0.0-RC.x (prior to RC.3) allows authenticated teacher-role users to execute arbitrary system commands via unsanitized file path parameters. The move() function in fileManage.lib.php concatenates user-controlled move_to POST values directly into exec() shell commands without proper escaping. Any authenticated user can exploit this by creating a course (enabled by default), uploading a directory with shell metacharacters via Course Backup Import, then moving a document to trigger command execution as www-data. No public exploit identified at time of analysis.

Technical ContextAI

CWE-78 flaw stems from passing move_to POST parameter through Security::remove_XSS() HTML filter only, then directly concatenating into exec("mv $source $target") without escapeshellarg(). Shell metacharacters in directory names created via backup import bypass sanitization, enabling command injection at filesystem layer when document move operation executes.

RemediationAI

Vendor-released patches: upgrade to Chamilo LMS 1.11.38 for 1.x deployments or 2.0.0-RC.3 for 2.0.0 release candidate deployments. Fixes implement escapeshellarg() sanitization in fileManage.lib.php move() function per commits 3597b19b73d73d681e4fb503285e9bbfe71714bf and 62671e5e268f235cddfba704edee90f35c234df1. No workaround provided; patching is mandatory. If immediate upgrade is not feasible, disable allow_users_to_create_courses configuration setting and restrict course creation/teacher role assignment until patching is complete. Full vendor advisory: https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-59cv-qh65-vvrr