CVE-2026-33618CWE-95

Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings

High · published April 10, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00561 · 46.0th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2026-04-10T18:10Z
EPSS history
Timeline
  • 10 APR 18:10Z
    Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings
    cvelistv5