CVE-2025-50195: high-severity vulnerability in chamilo-lms
Chamilo: OS Command Injection in /plugin/vchamilo/views/manage.controller.php
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Chamilo learning management system contains a vulnerability that allows attackers to execute arbitrary operating system commands on the server through the vchamilo plugin. This could let an attacker take full control of the server.
OS command injection exists in /plugin/vchamilo/views/manage.controller.php in Chamilo versions prior to 1.11.30, allowing remote code execution with server-level privileges. The vulnerability is exploitable by injecting shell metacharacters into unsanitized input parameters that are passed to system command execution functions. Successful exploitation grants an attacker complete control over the affected server.
In the same product, most dangerous first.