CVE-2023-3533: Chamilo

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

Affected products

• Chamilo Chamilo: up to and including 1.11.20

Published 2023-11-28. Last modified 2026-06-17.