Chamilo LMS EUVD-2026-82420

No special conditions - remote unauthenticated exploitation against default configurations of Chamilo LMS <= 2.0.0, provided the CStudio plugin's import-project big-upload endpoint (public/plugin/CStudio/editor/import-project/inc/big-upload.php) is reachable. The specific prerequisite is that this CStudio upload flow is deployed/accessible, since the fix confirms it lacked any authentication check (api_get_user_id() was added) and lacked filename sanitization. Limiting factors are minimal: no user interaction, no authentication, and no non-default toggle are required per CVSS PR:N/UI:N - the only realistic limiter is whether the CStudio editor plugin is installed and network-reachable, and upgrading to 2.0.1 fully closes it.

This is a genuine top-tier priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N, S:U, C:H/I:H/A:H = 9.8) is corroborated rather than merely asserted: the GitHub Security Advisory (GHSA-g4c3-4g96-6g4m) titles it 'unauthenticated remote code execution,' and the fix commit (4bdba1b) directly confirms the mechanism - the CStudio 'big-upload' chunked upload endpoint took the filename straight from attacker-controlled input ($_FILES['bigUploadFile']['name'] and $_POST['name']) with no sanitization and no session/authentication gate, matching CWE-22 (Path Traversal) leading to arbitrary file write and code execution. The patch adds three defenses at once (an api_get_user_id() authentication check, api_replace_dangerous_char()/disable_dangerous_file() filename sanitization, and moving the final filename into server-side session state so a POST value cannot override it), which independently validates all three impacts. Signals that would normally temper urgency are absent or neutral: there is no EPSS score, no CISA KEV listing, and no named public exploit in the provided data, so per precision rules this is 'no public exploit identified at time of analysis' - NOT active exploitation. However, the fix commit is public and effectively a blueprint (it reveals the exact vulnerable parameter and traversal path), so weaponization is low-effort and the practical exploitability is high despite the missing EPSS/KEV signals. Net: high-CVSS AND high-real-risk; patch to 2.0.1 without delay.

An unauthenticated attacker sends a chunked upload to the CStudio import-project big-upload endpoint (public/plugin/CStudio/editor/import-project/inc/big-upload.php) and supplies a crafted filename containing directory-traversal sequences and a PHP extension, causing the reassembled file to be written to an attacker-chosen web-accessible location. The attacker then requests that uploaded PHP file to execute arbitrary code on the server. No authentication is required and no public exploit is identified at time of analysis, but the public fix commit discloses the exact vulnerable parameters.