CVE-2025-50193
Published: 02 March 2026
Summary
CVE-2025-50193 is a high-severity OS Command Injection (CWE-78) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-50193 is an OS command injection vulnerability (CWE-78) affecting Chamilo, an open-source learning management system. The issue impacts versions prior to 1.11.30 and is located in the file /plugin/vchamilo/views/import.php, where the POST parameter to_main_database allows injection of operating system commands. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Attackers with high privileges (PR:H) can exploit this over the network with low complexity and no user interaction. Successful exploitation enables arbitrary OS command execution, resulting in high impacts on confidentiality, integrity, and availability, potentially leading to full server compromise.
The vulnerability is patched in Chamilo version 1.11.30. Mitigation involves upgrading to this version or later. Key resources include the patching commit at https://github.com/chamilo/chamilo-lms/commit/afdbd4bb9a9ea17b7740559dd4e05aa13b16480d, the release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30, and the GitHub security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-hvpp-6mp9-frx4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208162
Vulnerability details
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in a web app directly enables T1190 (public-facing exploit) and T1059 (arbitrary command execution via shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch (v1.11.30) that removes the OS command injection flaw in import.php.
Mandates validation and sanitization of the to_main_database POST parameter to block CWE-78 OS command injection.
Limits the number of users granted the high privileges (PR:H) required to reach the vulnerable import endpoint.