CVE-2023-3533

Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

• CWE-22
• CWE-22

• https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657aPatch
• https://starlabs.sg/advisories/23/23-3533/Exploit, Third Party Advisory
• https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-124-2023-07-13-Critical-impact-High-risk-Unauthenticated-Arbitrary-File-Write-RCE-CVE-2023-3533Issue Tracking, Patch, Vendor Advisory
• https://github.com/chamilo/chamilo-lms/commit/37be9ce7243a30259047dd4517c48ff8b21d657aPatch
• https://starlabs.sg/advisories/23/23-3533/Exploit, Third Party Advisory
• https://support.chamilo.org/projects/chamilo-18/wiki/security_issues#Issue-124-2023-07-13-Critical-impact-High-risk-Unauthenticated-Arbitrary-File-Write-RCE-CVE-2023-3533Issue Tracking, Patch, Vendor Advisory

Published

Nov 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35323Windows OLE Remote Code Execution Vulnerability7.8
• CVE-2023-35324Microsoft PostScript and PCL6 Class Printer Driver Informati…5.5
• CVE-2023-35325Windows Print Spooler Information Disclosure Vulnerability7.5
• CVE-2023-35326Windows CDP User Components Information Disclosure Vulnerabi…5.5
• CVE-2023-35328Windows Transaction Manager Elevation of Privilege Vulnerabi…7.8
• CVE-2023-35329Windows Authentication Denial of Service Vulnerability6.5
• CVE-2023-35330Windows Extended Negotiation Denial of Service Vulnerability7.5
• CVE-2023-35331Windows Local Security Authority (LSA) Denial of Service Vul…6.5
• CVE-2023-35332Windows Remote Desktop Protocol Security Feature Bypass6.8
• CVE-2023-35333MediaWiki PandocUpload Extension Remote Code Execution Vulne…7.5
• CVE-2023-35335Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vu…8.2
• CVE-2023-35336Windows MSHTML Platform Security Feature Bypass Vulnerabilit…5.4