CVE-2026-33618
High · 8.8CVSS
8.8
EPSS
0.6%
Published
Apr 10, 2026
CISA due date
—
The record
Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker with admin access (obtainable via Advisory 1) can inject arbitrary PHP code into the settings, which is then executed when any user (including unauthenticated) requests /platform-config/list. This vulnerability is fixed in 2.0.0-RC.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-85165 n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free… CWE-95
- CVE-2026-19295 IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute… CWE-95
- CVE-2026-54569 SENAITE.CORE is the core framework for the SENAITE laboratory information management… CWE-95
- CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in… CWE-95
- CVE-2026-71867 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
- CVE-2026-71865 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
- CVE-2026-71866 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95
- CVE-2026-71864 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2… CWE-95