CVE-2026-44344

The record

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple `eval()` calls in the vendored PEAR `HTML_QuickForm` libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

Affected packages

Related vulnerabilities

• CVE-2026-115943 Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of… CWE-95
• CVE-2026-90872 Improper neutralization of directives in dynamically evaluated code in the Manager web… CWE-95
• CVE-2026-119121 Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the… CWE-95
• CVE-2026-44179 XWiki Remote Macros provides XWiki rendering macros that are useful when migrating… CWE-95
• CVE-2026-85165 n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free… CWE-95
• CVE-2026-19295 IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute… CWE-95
• CVE-2026-54569 SENAITE.CORE is the core framework for the SENAITE laboratory information management… CWE-95
• CVE-2026-75062 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in… CWE-95