CVE-2021-31933

A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper…

High · published April 30, 2021

CVSS v3.1

7.2

EPSS

14%

Percentile

96.5

In the wild

Unconfirmed

What it is

A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:N
CVSS v4.0: Not supplied
EPSS: 0.13933 · 96.5th percentile
Published: 2021-04-30T20:49Z

EPSS history

Timeline

30 APR 20:49Z
A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper…
cvelistv5