CVE-2026-31939

Katalog CVE

CVSS 8.3 · High EPSS 0,53%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada chamilo lms. Skor CVSS 3.1 8.3 (High) menurut github.com.

Deskripsi (NVD)

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-8q8c-v75x-q2hx advisory vendor
• https://github.com/chamilo/chamilo-lms/commit/4dddcc19d36119da27b7c49eb84a035800abae78 patch
• https://github.com/chamilo/chamilo-lms/releases/tag/v1.11.38 release notes