CVE-2025-50187CWE-95

Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

Critical · published March 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-03-02T14:37Z
EPSS history
Timeline
  • 02 MAR 14:37Z
    Chamilo: Evaluation of untrusted user input leads to Remote Code Execution
    cvelistv5