CVE-2023-34944
Critical · CVSS 9.8Chamilo LMS — Arbitrary File Upload leading to Remote Code Execution (SVG upload)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-434
Description
An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG file.
Search profile — drives PoC discovery
Symbols fileUpload.lib.php/fileUpload.lib.phpchamilo-lmsSVG file upload0d0c88c4806280ac9b70a299d6e3099269c9bc54f6e83550c2d17fc93a65ec4be602a78312289f37
Keywords CVE-2023-34944ChamilofileUpload.lib.phparbitrary file uploadSVG upload RCEChamilo 1.11chamilo-lms exploitCWE-434 Chamilo
Versions: 1.11.* up to v1.11.18
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0msegoviag/msegoviag needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://github.com/chamilo/chamilo-lms/commit/0d0c88c4806280ac9b70a299d6e3099269c9bc54
- https://github.com/chamilo/chamilo-lms/commit/f6e83550c2d17fc93a65ec4be602a78312289f37
- https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-113-2023-05-31-Low-impact-Low-risk-XSS-through-SVG
- http://chamilo.com
- https://github.com/chamilo/chamilo-lms/commit/0d0c88c4806280ac9b70a299d6e3099269c9bc54
- https://github.com/chamilo/chamilo-lms/commit/f6e83550c2d17fc93a65ec4be602a78312289f37
- https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-113-2023-05-31-Low-impact-Low-risk-XSS-through-SVG
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z