{"id":"CVE-2026-44344","kind":"vulnerability","aliases":["CVE-2026-44344"],"related":[],"title":"Chamilo LMS: form element names let attackers run PHP code","description":"Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.","summary":"Chamilo LMS bundles PEAR HTML_QuickForm code that passes form element names to eval(). If attacker-controlled input reaches those names, an attacker can run arbitrary PHP code on the server.","severity":"medium","cvss":6.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chamilo","lms","php","runtime","self-hosted"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Check the installed Chamilo version in the platform admin panel or the `version` setting, and compare it with the fixed versions.\n- Look for custom plugins or modifications that build form element names from user input.","fix":"- Chamilo 1.x: upgrade to `1.11.40` or later.\n- Chamilo 2.x: upgrade to `2.0.1` or later.","status":"open","published_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:28+00:00","updated_at":"2026-10-30T15:33:28+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T15:33:28Z","model":"claude-haiku-5-5","output":{"fix":"- Chamilo 1.x: upgrade to `1.11.40` or later.\n- Chamilo 2.x: upgrade to `2.0.1` or later.","reach":"internet","title":"Chamilo LMS: form element names let attackers run PHP code","impact":"high","summary":"Chamilo LMS bundles PEAR HTML_QuickForm code that passes form element names to eval(). If attacker-controlled input reaches those names, an attacker can run arbitrary PHP code on the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["chamilo","php","self-hosted","lms"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary PHP code on the server","analyst_note":"Check the NVD entry for the attack vector and privileges required; confirm whether any default Chamilo feature reaches the vulnerable eval() paths.","how_to_check":"- Check the installed Chamilo version in the platform admin panel or the `version` setting, and compare it with the fixed versions.\n- Look for custom plugins or modifications that build form element names from user input.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","patched-version"],"who_is_affected":"Chamilo LMS installations on the 1.x line before 1.11.40 or the 2.x line before 2.0.1. Exploitation needs a developer-specific plugin or misconfiguration that lets user input reach form element names; standard forms with hardcoded names are not reachable this way. Sites running only standard Chamilo forms with no custom form code are lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4211,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-44344':13A,16A '1':68C '1.11.40':72C,146C '2':75C '2.0.1':79C,148C 'arbitrari':50B,92C 'attack':7A,40B,47B,101C 'attacker-control':39B 'attacker-influenc':100C 'bundl':26B 'call':82C 'chamilo':1A,17B,24B,56C,105C 'code':10A,30B,52B,94C 'compromis':139C 'condit':130C 'contain':99C 'control':41B 'cve':11A,14A 'data':103C 'develop':115C 'developer-specif':114C 'element':4A,34B,97C,109C,126C 'eval':37B,81C 'execut':91C 'exist':132C 'exploit':111C 'fix':143C 'form':3A,33B,96C,106C 'full':137C 'hardcod':108C 'host':23B 'html':28B,87C 'impact':134C 'influenc':102C 'input':42B,123C 'issu':141C 'learn':63C 'let':6A,121C 'librari':89C 'line':70C,77C 'lms':2A,18B,25B,57C 'manag':64C 'misconfigur':119C 'multipl':80C 'name':5A,35B,45B,98C,110C,127C 'open':61C 'open-sourc':60C 'pass':32B 'path':131C 'pear':27B,86C 'php':9A,19B,51B,93C 'plugin':117C 'quickform':29B,88C 'reach':43B,124C 'requir':112C 'run':8A,49B 'runtim':20B 'self':22B 'self-host':21B 'server':55B,138C 'sourc':62C 'specif':116C 'standard':104C 'system':65C 'use':107C 'user':122C 'vendor':85C 'version':145C 'x':69C,76C","nicknames":[],"mitigations":[],"who_affected":"Chamilo LMS installations on the 1.x line before 1.11.40 or the 2.x line before 2.0.1. Exploitation needs a developer-specific plugin or misconfiguration that lets user input reach form element names; standard forms with hardcoded names are not reachable this way. Sites running only standard Chamilo forms with no custom form code are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-44344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44344","severity":null,"published_at":"2026-10-30T15:16:51+00:00","modified_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}