Vulnerability · Published Mar 2, 2026 · Assigned by GitHub_M

CVE-2024-47886Chamilo: Post-Auth Remote Code Execution

High 8.7

In plain English

A high-severity unsafe deserialization in chamilo-lms from chamilo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)1.1%top 35.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	>= 1.11.12, < 1.11.28

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-c4fc-vjm9-9mvc x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28 x_refsource_MISC