Vulnerability · Published Mar 16, 2026 · Assigned by GitHub_M

CVE-2026-30875Chamilo LMS: Authenticated RCE via H5P Import

High 8.8

In plain English

A high-severity code injection in chamilo-lms from chamilo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.

Affected products (as reported)

Vendor	Product	Versions
chamilo	chamilo-lms	< 1.11.36

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 x_refsource_MISC