CVE-2026-32892
CriticalSummary
Chamilo LMS to system zarządzania nauczaniem, który przed wersjami 1.11.38 i 2.0.0-RC.3 zawiera podatność na wstrzykiwanie poleceń systemowych w funkcji przenoszenia plików. Funkcja move() w pliku fileManage.lib.php przekazuje wartości ścieżek kontrolowane przez użytkownika bezpośrednio do poleceń powłoki exec(), co umożliwia atakującym wykonanie nieautoryzowanych poleceń.
Risk Assessment
Podatność ta stwarza ryzyko dla organizacji, ponieważ każdy uwierzytelniony użytkownik, który jest nauczycielem w kursie, może wykorzystać tę lukę do wykonania dowolnych poleceń systemowych. Może to prowadzić do poważnych naruszeń bezpieczeństwa i utraty danych.
Recommendation
Zaleca się aktualizację Chamilo LMS do wersji 1.11.38 lub 2.0.0-RC.3, aby usunąć tę podatność. Dodatkowo, warto ograniczyć uprawnienia użytkowników do przenoszenia plików oraz monitorować system w celu wykrycia potencjalnych prób ataków.
Related vulnerabilities
- CVE-2026-7826Critical
A vulnerability in FalkorDB before 4.18.4 causes a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function. A remote attacker who can issue Redis replication commands (e.g., against an instance with no password) can send a crafted RDB stream with a sub-buffer length field exceeding the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
- CVE-2026-5759Critical
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders in FalkorDB before 4.18.1. A remote attacker who can issue Redis replication commands can send a crafted RDB stream where the deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
- CVE-2026-96207Critical
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-94510Critical
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-88131Critical
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- CVE-2026-77900Critical
Missing authentication for a critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-69435Critical
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- CVE-2026-84249Critical
IBM Guardium Data Protection 12.2 and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for a critical function.
- CVE-2026-80381Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
- CVE-2026-75875Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
Original NVD description (English source)
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file move function. The move() function in fileManage.lib.php passes user-controlled path values directly into exec() shell commands without using escapeshellarg(). When a user moves a document via document.php, the move_to POST parameter — which only passes through Security::remove_XSS() (an HTML-only filter) — is concatenated directly into shell commands such as exec("mv $source $target"). By default, Chamilo allows all authenticated users to create courses (allow_users_to_create_courses = true). Any user who is a teacher in a course (including self-created courses) can move documents, making this vulnerability exploitable by any authenticated user. The attacker must first place a directory with shell metacharacters in its name on the filesystem (achievable via Course Backup Import), then move a document into that directory to trigger arbitra
Vulnerability data from NVD (NIST) · CISA KEV · EPSS