Chamilo is an open-source learning management system that, despite a narrow product footprint, occupies a prominent position in the educational and training software landscape and is widely deployed across institutions globally. Vulnerabilities affecting the platform skew toward serious outcomes, with a substantial share reaching critical severity, reflecting the web-facing nature of the application and its handling of user data, file uploads, and administrative functions. The exposure recurs consistently through application-layer weakness classes including cross-site scripting, SQL injection, unrestricted file uploads, OS command injection, and authorization bypass mechanisms, which are characteristic of server-side web applications that accept and process user input without sufficient sanitization and access controls. Defenders should treat Chamilo instances as high-value targets for patching and implement input validation, output encoding, and strict file-upload policies; live exploitation and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Chamilo over time
Signals from CVEs in this vendor scope (148 CVEs).
148 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-34960CRITICAL A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted | Aug 1, 2023 | 9.8 | 92 | NO | YES |
CVE-2023-4220MEDIUM Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to p | Nov 28, 2023 | 6.1 | 84 | NO | YES |
CVE-2023-3368CRITICAL Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutral | Nov 28, 2023 | 9.8 | 77 | NO | YES |
CVE-2021-34187CRITICAL main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. | Jun 28, 2021 | 9.8 | 50 | NO | YES |
CVE-2021-31933HIGH A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filteri | Apr 30, 2021 | 7.2 | 41 | NO | YES |
CVE-2025-50187CRITICAL Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has b | Mar 2, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-33707CRITICAL Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no | Apr 10, 2026 | 9.8 | 33 | NO | NO |
CVE-2026-28430CRITICAL Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary SQ | Mar 16, 2026 | 9.8 | 33 | NO | NO |
CVE-2025-50190CRITICAL Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This | Mar 2, 2026 | 9.8 | 33 | NO | NO |
CVE-2026-33698CRITICAL Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated | Apr 10, 2026 | 9.8 | 32 | NO | NO |
Signals from CVEs in this vendor scope (148 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Chamilo.
Media articles that mention a CVE ID that affects a product developed by Chamilo — matched by CVE ID, not by vendor name.