We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2018-25158

CVE-2018-25158

PHP

Severity: HIGH
CVSS: 8.8CVSS
Published: 2026-02-20
Last modified: 2026-02-23
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Description

Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.

References

https://github.com/chamilo/chamilo-lms
https://www.exploit-db.com/exploits/47423
https://www.vulncheck.com/advisories/chamilo-lms-arbitrary-file-upload-via-elfinder

Summary

Description

References