CVE-2024-47886
Post-Auth Phar Unserialize RCE in Chamilo vchamilo Plugin
Publication date: 2026-03-02
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chamilo | chamilo_lms | From 1.11.12 (inc) to 1.11.26 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2024-47886 is a high-severity vulnerability in the Chamilo Learning Management System versions 1.11.12 through 1.11.26. It is a post-authentication remote code execution (RCE) flaw caused by unsafe deserialization of untrusted data via a phar unserialize operation within the virtualization plugin called "vchamilo."'}, {'type': 'paragraph', 'content': 'An authenticated administrator can exploit this vulnerability by uploading a specially crafted phar payload disguised as an image file. The attacker then configures the plugin to use the "phar://" stream wrapper pointing to this payload, which triggers the unsafe unserialize process and leads to arbitrary code execution on the server.'}, {'type': 'paragraph', 'content': 'The exploit involves multiple features of the vchamilo plugin and requires clearing the application cache to successfully replay the attack. This vulnerability was patched in Chamilo version 1.11.28.'}] [1]
How can this vulnerability impact me? :
This vulnerability allows an authenticated administrator to execute arbitrary code on the server hosting the Chamilo LMS. This means an attacker could potentially take full control of the server, leading to data theft, data manipulation, service disruption, or further attacks within the network.
Because the exploit requires administrator access, the impact depends on the security of administrator credentials. However, once exploited, it can compromise the confidentiality, integrity, and availability of the system and its data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if your Chamilo LMS installation is running a vulnerable version between 1.11.12 and 1.11.26 and if the virtualization plugin "vchamilo" is enabled.'}, {'type': 'paragraph', 'content': 'Detection involves verifying the presence of suspicious uploaded files (e.g., phar payloads disguised as images) and monitoring for unusual plugin configurations that use the "phar://" stream wrapper.'}, {'type': 'paragraph', 'content': 'Specific commands to assist detection might include:'}, {'type': 'list_item', 'content': 'Check Chamilo version: Inspect the version file or use the application interface to confirm the installed version.'}, {'type': 'list_item', 'content': 'List uploaded files in the file upload directories to find suspicious .png files that might be phar payloads.'}, {'type': 'list_item', 'content': 'Search for plugin configuration files or database entries referencing "phar://" to detect if the plugin is configured to use the phar stream wrapper.'}, {'type': 'list_item', 'content': 'Monitor web server logs for requests to the virtualization plugin URLs that might trigger the unserialize operation.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to upgrade Chamilo LMS to version 1.11.28 or later, where this vulnerability has been patched.'}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, consider disabling the virtualization plugin "vchamilo" to prevent exploitation.'}, {'type': 'paragraph', 'content': 'Additionally, review and remove any suspicious uploaded files that could be malicious phar payloads.'}, {'type': 'paragraph', 'content': 'Clear the application cache after remediation steps to prevent replay of the exploit.'}] [1]