CVE-2021-31933

CVE-2021-31933 is a remote code execution vulnerability affecting Chamilo through version 1.11.14. It stems from insufficient input sanitization during file uploads and improper filtering of file extensions like .phar or .pht. An authenticated administrator can exploit this by uploading malicious PHP code via directory traversal, leading to arbitrary code execution on the server. The vulnerability has a CVSS score of 7.2 (HIGH), indicating a high-impact threat with complete confidentiality, integrity, and availability compromise. Its attack vector is network-based with low attack complexity, requiring high privileges for exploitation. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB. Despite this, there is no evidence of active exploitation, and community discussion and media coverage remain minimal.