CVE-2025-50197
Published: 02 March 2026
Summary
CVE-2025-50197 is a high-severity OS Command Injection (CWE-78) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in a web application directly enables exploitation of public-facing apps (T1190) and arbitrary command execution via shell interpreters (T1059).
NVD Description
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.
Deeper analysisAI
CVE-2025-50197 is an OS Command Injection vulnerability (CWE-78) affecting Chamilo, an open-source learning management system. The flaw exists in the file /main/admin/sub_language_ajax.inc.php, where the POST new_language parameter is processed without proper sanitization, allowing arbitrary command execution on the underlying operating system. It impacts all versions of Chamilo prior to 1.11.30 and was published on 2026-03-02 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with high privileges, such as an administrator, can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a malicious payload in the new_language POST parameter during an AJAX request to the affected endpoint, the attacker can execute arbitrary operating system commands. This leads to high-impact consequences, including unauthorized access to sensitive data (C:H), modification of system files or configurations (I:H), and potential denial of service or full server compromise (A:H).
The vulnerability has been addressed in Chamilo version 1.11.30, where the issue was patched via a commit available at https://github.com/chamilo/chamilo-lms/commit/e1c7879d63172cd7e5e47c9a03ade0e32023e134. Security practitioners should upgrade to this version immediately, as detailed in the release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.30 and the GitHub Security Advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-m76m-95c9-6h7r.
Details
- CWE(s)