CVE-2026-30875
Published: 16 March 2026
Summary
CVE-2026-30875 is a high-severity Code Injection (CWE-94) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Prompt remediation by patching to version 1.11.36 directly eliminates the arbitrary file upload vulnerability in the H5P Import feature.
Comprehensive validation of H5P package contents, beyond just h5p.json existence, blocks uploads of .htaccess files and PHP webshells disguised with alternative extensions.
Secure web server configuration settings prevent .htaccess files from enabling PHP execution on non-PHP extensions like .txt, mitigating the RCE bypass even if uploads occur.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload in public-facing Chamilo LMS enables exploitation of public-facing application (T1190) to deploy a web shell (T1505.003) for remote code execution.
NVD Description
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if…
more
h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.
Deeper analysisAI
CVE-2026-30875 is an arbitrary file upload vulnerability in the H5P Import feature of Chamilo LMS, an open-source learning management system. Versions prior to 1.11.36 are affected, as the H5P package validation only verifies the existence of an h5p.json file but does not prevent the inclusion of .htaccess files or PHP code disguised with alternative extensions.
Authenticated users with the Teacher role can exploit this vulnerability over the network with low complexity and no user interaction required. By uploading a specially crafted H5P package containing a webshell and an .htaccess file that enables PHP execution on .txt files, attackers bypass security controls to achieve remote code execution (RCE). The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-94 (Improper Control of Generation of Code).
The vulnerability has been patched in Chamilo LMS version 1.11.36. Security practitioners should upgrade to this version immediately. Additional details are available in the GitHub release notes at https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.36 and the security advisory at https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-mj4f-8fw2-hrfm.
Details
- CWE(s)