CVE-2025-50194: high-severity vulnerability in chamilo-lms
Chamilo: OS Command Injection in /main/cron/lang/check_parse_lang.php
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Chamilo, a learning management system, has a vulnerability in its language checking tool that allows attackers to run harmful system commands on the server. This can lead to complete server compromise if not patched.
An OS command injection vulnerability exists in /main/cron/lang/check_parse_lang.php prior to version 1.11.30, allowing unauthenticated attackers to execute arbitrary system commands through unsanitized input. The attack vector requires access to the cron endpoint, potentially enabling remote code execution with server privileges.
In the same product, most dangerous first.