Pfadüberschreitung (Beliebiges Löschen von Dateien) in Chamilo LMS

The core of this vulnerability lies in the main/exercise/savescores.php file, where user-supplied input from the $_REQUEST['test'] parameter is directly concatenated into a filesystem path without proper sanitization or canonicalization. This lack of validation enables an attacker to craft malicious input that bypasses intended access controls and manipulates the file path. Successful exploitation could lead to the deletion of critical system files, potentially disrupting the LMS functionality or even compromising the entire server. While the description specifically mentions file deletion, the potential for other file system manipulations cannot be ruled out, depending on the server's configuration and permissions.

Organizations and institutions utilizing Chamilo LMS versions 1.11.0 through 1.11.37 are at risk. This includes educational institutions, training providers, and any entity relying on Chamilo LMS for learning management purposes. Shared hosting environments running vulnerable Chamilo LMS installations are particularly vulnerable due to the potential for cross-tenant exploitation.

• php: Examine web server access logs for requests to main/exercise/savescores.php containing path traversal sequences (e.g., ../..). • php: Monitor file system activity for unexpected file deletions within the Chamilo LMS installation directory. • generic web: Use curl to test the main/exercise/savescores.php endpoint with a crafted payload like curl 'http://your-chamilo-instance/main/exercise/savescores.php?test=../../../../etc/passwd' to check for file access outside the intended directory.

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-03-10
2. Veröffentlicht2026-04-10
3. Geändert2026-04-13
4. EPSS aktualisiert2026-04-18

The primary mitigation for CVE-2026-31939 is to immediately upgrade Chamilo LMS to version 1.11.38 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters or patterns in the test parameter. Additionally, restrict file system permissions for the Chamilo LMS user to minimize the potential impact of a successful attack. Monitor access logs for unusual file access patterns, particularly those involving the savescores.php file. After upgrading, verify the fix by attempting to access a restricted file via the test parameter; the request should be denied.