CVE-2026-29041

Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34.

• CWE-434

• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.34Product, Release Notes
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4pc3-4w2v-vwx8Mitigation, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29034Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-29035CivetWeb (commit 4a4f0c95) contains a heap and stack buffer …6.5
• CVE-2026-29036cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-r…7.5
• CVE-2026-29038changedetection.io is a free open source web page change det…6.1
• CVE-2026-29039changedetection.io is a free open source web page change det…7.5
• CVE-2026-2904A vulnerability was determined in UTT HiPER 810G 1.7.7-17111…8.8
• CVE-2026-29042Nuclio is a "Serverless" framework for Real-Time Events and …9.8
• CVE-2026-29043HDF5 is software for managing data. In 1.14.1-2 and earlier,…5.5
• CVE-2026-29044EVerest is an EV charging software stack. Prior to version 2…6.5
• CVE-2026-29045Hono is a Web application framework that provides support fo…9.8
• CVE-2026-29046TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …8.2
• CVE-2026-29047GLPI is a free asset and IT management software package. Fro…8.8