high CVSS 8.8

CVE-2026-30875·PHP vulnerability

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution (RCE). The H5P package validation only checks if h5p.json exists but doesn't block .htaccess or PHP files with alternative extensions. An attacker uploads a crafted H5P package containing a webshell and .htaccess that enables PHP execution for .txt files, bypassing security control. This issue has been patched in version 1.11.36.

Severity
high
Software
PHP
Fixed in
1.11.36
Published
2026-03-16

Affected versions

Until: 1.11.36

Fixed in: 1.11.36

How to fix this CVE

Upgrade Chamilo LMS to version 1.11.36 or later to patch the H5P import file upload vulnerability that allows authenticated teachers to execute arbitrary code. If you are running PHP alongside Chamilo LMS, ensure your PHP installation is current and monitor your web server logs for suspicious H5P package uploads or .htaccess file creation attempts.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /app/upload/h5p/.* (multipart/form-data containing .h5p file) | file creation: /app/upload/h5p.*/.htaccess | PHP execution in h5p upload directories with non-.h5p extensions

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or validate HTTP POST requests to H5P upload endpoints (/app/upload/h5p/) that contain .htaccess files or PHP executable content within multipart uploads. Restrict uploaded H5P packages to contain only whitelisted file types (json, png, jpg, css, js, woff, svg) and reject packages with alternative PHP extensions or web server configuration files.

How to check if you are affected

  1. Step 1: Check the installed Chamilo LMS version by running: grep -r 'VERSION\|version' /path/to/chamilo/config/version.php or checking the Admin panel under Settings > System Information
  2. Step 2: Identify if H5P functionality is enabled by verifying the h5p directory exists at /path/to/chamilo/app/upload/h5p/ and checking if H5P courses are present
  3. Step 3: Search web server logs for suspicious H5P upload activity: grep -i 'h5p\|.htaccess' /var/log/apache2/access.log | grep POST
  4. Step 4: Verify the patch by confirming Chamilo version is 1.11.36 or higher and review the h5p validation logic in /app/upload/h5p/handlers/ to ensure .htaccess and executable file uploads are blocked

Indicators of compromise

  • H5P packages containing .htaccess files with AddType or AddHandler directives
  • Webshell files with .txt extension in /app/upload/h5p/ directories after H5P imports
  • POST requests to /app/upload/h5p/ endpoints from teacher-role users outside normal business hours
  • .htaccess files created or modified in subdirectories of /app/upload/h5p/ after version 1.11.36 was released

FAQ

What is CVE-2026-30875?

CVE-2026-30875 is a remote code execution vulnerability in Chamilo LMS versions prior to 1.11.36 that allows authenticated teachers to upload malicious H5P packages containing webshells and .htaccess directives, enabling arbitrary PHP code execution on the server.

Is CVE-2026-30875 being actively exploited?

No, according to CISA's Known Exploited Vulnerabilities (KEV) catalog, there is no evidence of active exploitation in the wild at this time. However, the vulnerability requires only teacher-level privileges to exploit, making it a significant risk in multi-user LMS environments.

What versions of Chamilo LMS are affected by CVE-2026-30875?

All versions of Chamilo LMS prior to 1.11.36 are vulnerable. The exact earliest affected version is unknown, but all versions before 1.11.36 should be considered at risk.

How do I check if my server is vulnerable to CVE-2026-30875?

Run: grep -i version /path/to/chamilo/config/version.php to identify your Chamilo version. If it is earlier than 1.11.36 and H5P is enabled, your system is vulnerable.

Does Defensia detect CVE-2026-30875?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Chamilo LMS is installed on a monitored server, CVE-2026-30875 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-30875. Free for 1 server.

Get started free