CVE-2025-50197
Published: 02 March 2026
Summary
CVE-2025-50197 is a high-severity OS Command Injection (CWE-78) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-50197 is an OS Command Injection vulnerability (CWE-78) affecting Chamilo, an open-source learning management system. The flaw exists in the file /main/admin/sub_language_ajax.inc.php, where the POST new_language parameter is processed without proper sanitization, allowing arbitrary command execution on the underlying operating system. It impacts all versions of Chamilo prior to 1.11.30 and was published on 2026-03-02 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with high privileges, such as an administrator, can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a malicious payload in the new_language POST parameter during an AJAX request to the affected endpoint, the attacker can execute arbitrary operating system commands. This leads to high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system files or configurations (I:H), and potential denial of service or full server compromise (A:H).
The vulnerability has been addressed in Chamilo version 1.11.30, where the issue was patched via a commit available at https://github.com/chamilo/chamilo-lms/commit/e1c7879d63172cd7e5e47c9a03ade0e32023e134. Security practitioners should upgrade to this version immediately, as detailed in the release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 and the GitHub Security Advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m76m-95c9-6h7r.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208166
Vulnerability details
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in a web application directly enables exploitation of public-facing apps (T1190) and arbitrary command execution via shell interpreters (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the new_language POST parameter to block OS command injection payloads.
Mandates timely application of the vendor patch that eliminates the unsanitized parameter handling in sub_language_ajax.inc.php.
Restricts the number of high-privilege administrator accounts that can reach the vulnerable admin endpoint.