CVE-2023-34944

CriticalCVSS 9.8

Published: 13/06/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.07%

61th percentile - higher than 61% of all known CVEs

Summary

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo versions 1.11.* up to 1.11.18 allows attackers to upload crafted SVG files. This can lead to arbitrary code execution on the server.

Risk Assessment

The risk for the organization includes full server compromise, data theft, or malware infection.

Recommendation

Immediately upgrade Chamilo to version 1.11.19 or later, which includes a fix for this vulnerability. Additionally, consider restricting SVG file uploads or implementing file type validation.

Original NVD description (English source)

An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.