CVE-2026-32931

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type header to audio/mpeg. The uploaded file retains its original .php extension and is placed in a web-accessible directory, enabling Remote Code Execution as the web server user (www-data). This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

• CWE-434

• https://github.com/chamilo/chamilo-lms/commit/8cbe660de267f2b6ed625433bdfcf38dee8752b4Patch
• https://github.com/chamilo/chamilo-lms/commit/d5ef5153df3d1b2de112cbeb190cdd10bea457f3Patch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-863j-h6pf-3xhxVendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32926V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-32927V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-32928V-SFT versions 6.2.10.0 and prior contain a stack-based buff…8.4
• CVE-2026-32929V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-3293A weakness has been identified in snowflakedb snowflake-jdbc…5.5
• CVE-2026-32930Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-32932Chamilo LMS is a learning management system. Prior to 1.11.3…6.1
• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32934CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32935phpseclib is a PHP secure communications library. Projects u…5.9
• CVE-2026-32936CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32937free5GC is an open source 5G core network. free5GC CHF prior…6.5