CVE-2026-31940·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 12% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-31940 scores 7.5 on CVSS, so a successful attack would be serious — but at <0.1%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Update Chamilo LMS to version 1.11.38 or later to remediate CVE-2026-31940, which exploits improper session ID handling in the aicc_hacp.php file. The vulnerability allows attackers to hijack user sessions by manipulating request parameters before the application initializes its security framework. Ensure all PHP installations running Chamilo LMS are patched immediately, as session fixation attacks can lead to complete account compromise and unauthorized access to learning materials and administrative functions.

sudo dnf upgrade php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*aicc_hacp\.php.*PHPSESSID=[a-z0-9]{32}|POST.*aicc_hacp\.php.*session.*=(?!^[a-f0-9]{26}$)[a-z0-9]{10,}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or require authentication for access to /main/lp/aicc_hacp.php unless the request originates from trusted internal IPs. Implement strict session validation rules that prevent custom PHPSESSID parameters in request URIs or POST data from overriding server-generated session tokens.

How to check if you are affected

1. Check installed Chamilo LMS version: grep -r 'VERSION\|version' /var/www/html/chamilo/main/inc/conf/ | head -5
2. Verify if aicc_hacp.php is accessible: curl -I https://your-domain.com/main/lp/aicc_hacp.php
3. Search application logs for suspicious session parameter manipulation: grep -E 'aicc_hacp\.php.*PHPSESSID|aicc_hacp\.php.*session' /var/log/apache2/access.log /var/log/nginx/access.log
4. Confirm the fix by checking the aicc_hacp.php file for proper session validation: head -50 /path/to/chamilo/main/lp/aicc_hacp.php | grep -i 'session\|fixation\|validate'

FAQ

Related PHP CVEs

References

• https://github.com/chamilo/chamilo-lms/commit/ce0192c62e48c9d9474d915c541b3274844afbf9
• https://github.com/chamilo/chamilo-lms/commit/e337b7cc74a0276a0b4f91f9282204d20cac1869
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4gp7-cfjh-77gv