CVE-2026-31939: Chamilo Lms: dizin geçişi

Açıklama (NVD)

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Özet bilgiler

Ürün

Chamilo Chamilo Lms

CVSS v3.1

8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

EPSS

%0,35 (yüzdelik 29)

CWE

CWE-22

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• github.com
• github.com
• CWE-22