---
id: "CVE-2026-44344"
kind: "vulnerability"
aliases: ["CVE-2026-44344"]
title: "Chamilo LMS: form element names let attackers run PHP code"
severity: "medium"
cvss: 6.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["chamilo", "lms", "php", "runtime", "self-hosted"]
not_affected_if: ["default-config", "patched-version"]
published_at: "2026-10-30T15:16:51+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44344", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# Chamilo LMS: form element names let attackers run PHP code

Chamilo LMS bundles PEAR HTML_QuickForm code that passes form element names to eval(). If attacker-controlled input reaches those names, an attacker can run arbitrary PHP code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Chamilo version in the platform admin panel or the `version` setting, and compare it with the fixed versions.
- Look for custom plugins or modifications that build form element names from user input.

## Fix

- Chamilo 1.x: upgrade to `1.11.40` or later.
- Chamilo 2.x: upgrade to `2.0.1` or later.

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44344

## From the sources

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_