CVE-2023-34960

CriticalCVSS 9.8

Published: 01/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

99.19%

100th percentile - higher than 100% of all known CVEs

Summary

A command injection vulnerability in the wsConvertPpt component of Chamilo versions 1.11.* through 1.11.18. An attacker can execute arbitrary system commands via a SOAP API call with a crafted PowerPoint filename.

Risk Assessment

Risk of full server compromise, potentially leading to data theft, course content modification, or using the server for further attacks.

Recommendation

Immediately upgrade Chamilo to version 1.11.19 or later. If upgrade is not possible, restrict SOAP API access to trusted IP addresses only.

Original NVD description (English source)

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.