ZeroDay Findings
Sign inSign up

Findings

CVE-2026-31939

Chamilo LMS is a learning management system.

Published Apr 10, 2026 · updated Jun 17, 2026 · chamilo chamilo lms

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 10, 2026 · NIST NVD

    Detected

    Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

  2. Jun 17, 2026 · NIST NVD

    Updated

    Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Affected

  • cpe chamilo/chamilo lmsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-31939

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-31939

    Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal check

    nvd.nist.gov

References