Live › vulnerability › CVE-2026-44344
Chamilo LMS bundles PEAR HTML_QuickForm code that passes form element names to eval(). If attacker-controlled input reaches those names, an attacker can run arbitrary PHP code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Chamilo LMS installations on the 1.x line before 1.11.40 or the 2.x line before 2.0.1. Exploitation needs a developer-specific plugin or misconfiguration that lets user input reach form element names; standard forms with hardcoded names are not reachable this way. Sites running only standard Chamilo forms with no custom form code are lower risk.
No product ranges from the sources yet.
version setting, and compare it with the fixed versions.1.11.40 or later.2.0.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval() calls in the vendored PEAR HTML_QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-44344")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.