CVE-2026-44344 in LMS
Summary
by MITRE • 10/30/2026
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
Chamilo Learning Management System (LMS) serves as a widely deployed open-source platform for educational institutions and corporate training environments, facilitating the delivery of online courses and assessments. Within specific legacy branches, namely the 1.x line prior to version 1.11.40 and the 2.x line prior to version 2.0.1, a critical security vulnerability exists within the application's form handling mechanisms. This flaw stems from the integration of third-party libraries, specifically the vendored PEAR HTML_QuickForm package, which is responsible for generating and processing web forms used throughout the system. The core technical deficiency lies in how these library functions process element names during form rendering and validation processes.
The vulnerability manifests as a Server-Side Code Injection flaw, technically classified under CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code or CWE-78 Improproper Neutralization of Special Elements used in an OS Command depending on the specific execution context within PHP's eval function. In standard operational scenarios, Chamilo utilizes hardcoded element names for its forms, which inherently mitigates this risk because user input does not directly influence these identifiers. However, when developers create custom plugins or implement misconfigurations that allow external user-supplied data to be passed as form element names, the application fails to adequately sanitize this input before it reaches vulnerable eval() calls within the HTML_QuickForm library.
When an attacker successfully injects malicious PHP code into a form element name through such a developer-specific plugin or configuration error, the compromised system executes this arbitrary code with the privileges of the web server process. This represents a severe operational impact, as successful exploitation leads to Remote Code Execution (RCE). An adversary can leverage this capability to take full control of the underlying server infrastructure, potentially leading to data exfiltration, lateral movement within the network, or complete system compromise. The attack vector is categorized under ATT&CK technique T1059 Command and Scripting Interpreter: PHP, highlighting the direct execution of malicious scripts on the target machine.
The severity of this vulnerability is contingent upon the specific deployment configuration, as it requires a conditional path where user input influences form element names rather than occurring in default out-of-the-box installations. Nevertheless, given the potential for full server compromise, immediate remediation is critical for any Chamilo instance running affected versions that utilize custom plugins or non-standard configurations involving dynamic form elements. The issue has been addressed and resolved in subsequent releases, specifically version 1.11.40 of the legacy branch and version 2.0.1 of the newer line. Administrators are strongly advised to upgrade their Chamilo installations to these patched versions immediately to eliminate the risk associated with this code injection vulnerability.