Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-44344— Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

Quick assessment

Affected

chamilo chamilo-lms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Chamilo LMS 是一个开源的学习管理系统。在 1.x 系列（1.11.40 之前）和 2.x 系列（2.0.1 之前）中，其依赖的 PEAR 库中存在多处调用。如果表单元素名称包含攻击者可控制的数据，这些调用可能导致任意 PHP 代码执行。Chamilo 的标准表单使用硬编码的元素名称，因此实际利用需要依赖开发者特定的插件或配置错误，使得用户输入能够影响这些元素名称。若存在此类条件路径，攻击者可能实现对服务器的完全控制。该问题已在版本 1.11.40 和 2.0.1 中修复。

CVSS 6.6 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Chamilo LMS: Conditional PHP execution through vendored QuickForm eval

Source: CVE Program / CVE List V5

Vulnerability Description

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

动态执行代码中指令转义处理不恰当(Eval注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
chamilo	chamilo-lms	< 1.11.40	-

II. Public POCs for CVE-2026-44344

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-44344

请登录查看更多情报信息。

Vendor Pages for CVE-2026-44344 (1)

🔗 Release v2.0.1 · chamilo/chamilo-lms · GitHub x_refsource_MISC

Other References for CVE-2026-44344 (5)

https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.40 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-8rj2-88v5-mx6w x_refsource_CONFIRM
https://github.com/chamilo/chamilo-lms/commit/a7fcc222bd7a7c09fb1d84173f710154c019bb7d x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/c497f7ef7fadeabb80ba27046a3ad5ce0edfc139 x_refsource_MISC
https://github.com/chamilo/chamilo-lms/commit/99d407a30e03c06cf764649dae85b4043877959a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-44344

Same Patch Batch · chamilo · 2026-10-30 · 4 CVEs total

CVE-2026-45144	8.9 HIGH	Chamilo LMS: Stored XSS in public user-profile fields
CVE-2026-45145	7.5 HIGH	Chamilo LMS: Database-backed PHP object injection in career deserialization
CVE-2026-45141	6.5 MEDIUM	Chamilo LMS: CSRF in destructive skill-management AJAX actions

IV. Related Vulnerabilities

Same product: chamilo-lms

Same vendor: chamilo

Same weakness: CWE-95