CVE-2026-30875
Published: 16 March 2026
Description
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if…
more
h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.
Mitigating Controls (NIST 800-53 r5)AI
Prompt remediation by patching to version 1.11.36 directly eliminates the arbitrary file upload vulnerability in the H5P Import feature.
Comprehensive validation of H5P package contents, beyond just h5p.json existence, blocks uploads of .htaccess files and PHP webshells disguised with alternative extensions.
Secure web server configuration settings prevent .htaccess files from enabling PHP execution on non-PHP extensions like .txt, mitigating the RCE bypass even if uploads occur.
Security SummaryAI
CVE-2026-30875 is an arbitrary file upload vulnerability in the H5P Import feature of Chamilo LMS, an open-source learning management system. Versions prior to 1.11.36 are affected, as the H5P package validation only verifies the existence of an h5p.json file but does not prevent the inclusion of .htaccess files or PHP code disguised with alternative extensions.
Authenticated users with the Teacher role can exploit this vulnerability over the network with low complexity and no user interaction required. By uploading a specially crafted H5P package containing a webshell and an .htaccess file that enables PHP execution on .txt files, attackers bypass security controls to achieve remote code execution (RCE). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-94 (Improper Control of Generation of Code).
The vulnerability has been patched in Chamilo LMS version 1.11.36. Security practitioners should upgrade to this version immediately. Additional details are available in the GitHub release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 and the security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing Chamilo LMS enables exploitation of public-facing application (T1190) to deploy a web shell (T1505.003) for remote code execution.