CVE-2026-33618

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.

• CWE-95

• https://github.com/chamilo/chamilo-lms/commit/f2c382c94a3f153a4d7e5ce5686c5a219fd09b3bPatch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hp4w-jmwc-pg7wVendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33612A malicious authoritative server can send a crafted zone via…7.5
• CVE-2026-33613Due to the improper neutralisation of special elements used …8.8
• CVE-2026-33614An unauthenticated remote attacker can exploit an unauthenti…7.5
• CVE-2026-33615An unauthenticated remote attacker can exploit an unauthenti…9.1
• CVE-2026-33616An unauthenticated remote attacker can exploit an unauthenti…7.5
• CVE-2026-33617An unauthenticated remote attacker can access a configuratio…5.3
• CVE-2026-33619PinchTab is a standalone HTTP server that gives AI agents di…5.5
• CVE-2026-3362The Short Comment Filter plugin for WordPress is vulnerable …4.4
• CVE-2026-33620PinchTab is a standalone HTTP server that gives AI agents di…4.3
• CVE-2026-33621PinchTab is a standalone HTTP server that gives AI agents di…6.5
• CVE-2026-33622PinchTab is a standalone HTTP server that gives AI agents di…8.8
• CVE-2026-33623PinchTab is a standalone HTTP server that gives AI agents di…7.2