CVE-2026-31939: Chamilo Lms

High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38.

Affected products

• Chamilo Chamilo Lms: before 1.11.38 (fixed in 1.11.38)

Published 2026-04-10. Last modified 2026-06-17.