CVE-2018-25158CWE-434

Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder

High · published February 20, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-02-20T22:54Z
EPSS history
Timeline
  • 20 FEB 22:54Z
    Chamilo LMS 1.11.8 Arbitrary File Upload via elfinder
    cvelistv5