CVE-2026-32892

The move() function in fileManage.lib.php passes user-controlled path values directly to shell commands executed by exec() without using escapeshellarg(). The POST parameter move_to is only filtered through Security::remove_XSS(), which removes only HTML tags without neutralizing shell metacharacters. The attacker must first place a directory containing shell metacharacters in its name on the server (possible through the course backup import function), then move a document into it — causing concatenation of the malicious path name into the exec("mv $source $target") command and thus executing arbitrary code. Default Chamilo configuration allows all authenticated users to create courses, making the required teacher context achievable by any logged-in user.

An attacker can execute arbitrary system commands in the context of the web server user (www-data), which may lead to complete server takeover, data breach, and compromise of other systems accessible from the server.

Update Chamilo LMS to version 1.11.38 or later (1.x branch) or to version 2.0.0-RC.3 or later (2.x branch). Patches are available in vendor references: commit 3597b19b73d73d681e4fb503285e9bbfe71714bf and commit 62671e5e268f235cddfba704edee90f35c234df1. Additionally, as a remedial measure, consider disabling course creation by regular users (allow_users_to_create_courses = false) and restricting access to the course backup import function.

Chamilo LMS in versions earlier than 1.11.38 (1.x branch) and earlier than 2.0.0-RC.3 (2.x branch)