CVE-2026-31939

🗓️ 10 Apr 2026 17:32:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2 Views🌐 WEB

Chamilo learning system path traversal allows arbitrary file deletion via parameter; fixed in version 1.11.38.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-31939	10 Apr 202617:32	–	attackerkb
Circl	CVE-2026-31939	10 Apr 202619:12	–	circl
CNNVD	Chamilo LMS 安全漏洞	10 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-31939 Path Traversal (Arbitrary File Delete) in Chamilo LMS	10 Apr 202617:32	–	cvelist
EUVD	EUVD-2026-21521	10 Apr 202617:32	–	euvd
NVD	CVE-2026-31939	10 Apr 202618:16	–	nvd
Positive Technologies	PT-2026-31999	10 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-31939	13 Apr 202619:23	–	redhatcve
Vulnrichment	CVE-2026-31939 Path Traversal (Arbitrary File Delete) in Chamilo LMS	10 Apr 202617:32	–	vulnrichment

NVD

Vulners

Node

chamilo chamilo_lmsRange<1.11.38

[
  {
    "vendor": "chamilo",
    "product": "chamilo-lms",
    "versions": [
      {
        "version": "< 1.11.38",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/chamilo/chamilo-lms/releases/tag/v1.11.38
github	www.github.com/chamilo/chamilo-lms/commit/4dddcc19d36119da27b7c49eb84a035800abae78
github	www.github.com/chamilo/chamilo-lms/security/advisories/GHSA-8q8c-v75x-q2hx

Parameter	Position	Path	Description	CWE
test	query param	main/exercise/savescores.php	Path traversal via unsanitized user input ($_REQUEST['test']) concatenated into filesystem path, allowing arbitrary file deletion prior to patch.	CWE-22, CWE-73

17 Apr 2026 21:23Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.3

EPSS0.00079

SSVC