Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The following versions are currently being supported with security updates.

Version	Supported
3.0.*	✅
2.0.*	✅
1.11.42	(to be released)
1.11.40	✅
1.11.38	✅
1.11.36	✅
1.11.34	❌
1.11.32	❌
<=1.11.30	❌

Reporting a Vulnerability

Please follow the instructions at https://github.com/chamilo/chamilo-lms/wiki/security-issues to report vulnerabilities.

SQL Injection in ExtraField::get_where_clause() via unescaped array filter values (<1.11.42, <2.0.3)
GHSA-7whw-8467-78jp published Aug 4, 2026 by ywarnier

High
Incomplete fix for CVE-2026-31941 SSRF: OpenGraph fetch path reachable via redirect and DNS rebinding (<1.11.42)
GHSA-x6gc-5g5m-hm3r published Aug 30, 2026 by ywarnier

High
Missing Source-Course Authorization in Course Maintenance Copy Endpoints (<2.0.3)
GHSA-7g97-jh3w-53wh published Aug 4, 2026 by ywarnier

Moderate
Unauthenticated Template Creation via /template/document-templates/create (<2.0.3)
GHSA-hg2v-955j-35c3 published Aug 4, 2026 by ywarnier

Moderate
Unauthenticated Template Deletion (<2.0.3)
GHSA-37fh-r78h-9vvr published Aug 4, 2026 by ywarnier

High
Unauthenticated Disclosure of Private Course Template Content (< 2.0.3)
GHSA-9r7v-p62p-h9gc published Aug 4, 2026 by ywarnier

High
Unrestricted switch_user impersonation (< 2.0.3)
GHSA-35wp-xr4v-jg99 published Aug 4, 2026 by ywarnier

Critical
Self-registration role mass-assignment (< 1.11.40, < 2.0.3)
GHSA-3v23-qp3p-p2xf published Aug 4, 2026 by ywarnier

High
Path traversal + arbitrary file write via sub-language admin panel (< 2.0.3)
GHSA-rpp3-vpc9-w3h2 published Aug 4, 2026 by ywarnier

Critical
Authenticated path traversal in FileManagerController download endpoint allows arbitrary file read (< 2.0.3)
GHSA-7jqm-3829-36cm published Aug 4, 2026 by ywarnier

High

Learn more about advisories related to chamilo/chamilo-lms in the GitHub Advisory Database