CVE-2026-31940·PHP vulnerability

Affected versions

How to fix this CVE

Update Chamilo LMS to version 1.11.38 or later to remediate CVE-2026-31940, which exploits improper session ID handling in the aicc_hacp.php file. The vulnerability allows attackers to hijack user sessions by manipulating request parameters before the application initializes its security framework. Ensure all PHP installations running Chamilo LMS are patched immediately, as session fixation attacks can lead to complete account compromise and unauthorized access to learning materials and administrative functions.

sudo dnf upgrade php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET.*aicc_hacp\.php.*PHPSESSID=[a-z0-9]{32}|POST.*aicc_hacp\.php.*session.*=(?!^[a-f0-9]{26}$)[a-z0-9]{10,}

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or require authentication for access to /main/lp/aicc_hacp.php unless the request originates from trusted internal IPs. Implement strict session validation rules that prevent custom PHPSESSID parameters in request URIs or POST data from overriding server-generated session tokens.

How to check if you are affected

1. Check installed Chamilo LMS version: grep -r 'VERSION\|version' /var/www/html/chamilo/main/inc/conf/ | head -5
2. Verify if aicc_hacp.php is accessible: curl -I https://your-domain.com/main/lp/aicc_hacp.php
3. Search application logs for suspicious session parameter manipulation: grep -E 'aicc_hacp\.php.*PHPSESSID|aicc_hacp\.php.*session' /var/log/apache2/access.log /var/log/nginx/access.log
4. Confirm the fix by checking the aicc_hacp.php file for proper session validation: head -50 /path/to/chamilo/main/lp/aicc_hacp.php | grep -i 'session\|fixation\|validate'

FAQ

Related PHP CVEs

References

• https://github.com/chamilo/chamilo-lms/commit/ce0192c62e48c9d9474d915c541b3274844afbf9
• https://github.com/chamilo/chamilo-lms/commit/e337b7cc74a0276a0b4f91f9282204d20cac1869
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-4gp7-cfjh-77gv