CVE-2018-25158

HIGH

8.8

Description

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie2/20/2026

Derniere modification2/23/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-434

References

https://github.com/chamilo/chamilo-lms(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/47423(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/chamilo-lms-arbitrary-file-upload-via-elfinder(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.