CVE-2025-50187criticalCWE-95

CVE-2025-50187: critical vulnerability in chamilo-lms

Chamilo: Evaluation of untrusted user input leads to Remote Code Execution

Published

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
In short

Chamilo learning platform allows attackers to run arbitrary code on the server by sending specially crafted SOAP requests with unfiltered commands. This is critical because attackers can take complete control of the system and steal or destroy all educational data.

Technical detail

CWE-95 code injection vulnerability in Chamilo's SOAP request handler prior to v1.11.28 allows unauthenticated remote code execution via unsanitized parameter evaluation. Attack vector is network-based through SOAP endpoints; no authentication required. Successful exploitation grants arbitrary code execution with server privileges, enabling full system compromise.

Summary generated and translated by AI from the official description.
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
chamilo · chamilo-lms
Related CVEs — chamilo-lms

In the same product, most dangerous first.

CVE-2025-50196HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/editinstance.php via POST main_database parameterEPSS 2.8%CVE-2026-32892CRITICALOS Command Injection in Chamilo LMS 1.11.36EPSS 2.7%CVE-2025-50197HIGHChamilo: OS Command Injection in /main/admin/sub_language_ajax.inc.php via POST new_language parameterEPSS 2.7%CVE-2025-50195HIGHChamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.phpEPSS 2.7%CVE-2025-50194HIGHChamilo: OS Command Injection in /main/cron/lang/check_parse_lang.phpEPSS 2.7%CVE-2025-50193HIGHChamilo: OS command Injection in /plugin/vchamilo/views/import.php with the POST to_main_database parameterEPSS 2.7%
References
https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.28https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-356v-7xg2-3678