File and Path Handling

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. Chamilo LMS <= 1.11.24 - Remote Code ExecutionCVE-2023-4220Chamilo · CVSS 8.1 · 76% likely

   CWE-434

2. Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content, and on…CVE-2019-13082Chamilo · 4.0% likely

   CWE-434

3. Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File WriteCVE-2023-3533Chamilo · CVSS 9.8 · 3.5% likely

   CWE-22

4. Chamilo LMS File Upload Functionality Remote Code ExecutionCVE-2023-4226Chamilo · CVSS 8.8 · 2.5% likely

   CWE-434

5. Chamilo LMS File Upload Functionality Remote Code ExecutionCVE-2023-4225Chamilo · CVSS 8.8 · 1.8% likely

   CWE-434

6. Chamilo LMS File Upload Functionality Remote Code ExecutionCVE-2023-4223Chamilo · CVSS 8.8 · 1.8% likely

   CWE-434

7. Chamilo LMS File Upload Functionality Remote Code ExecutionCVE-2023-4224Chamilo · CVSS 8.8 · 1.8% likely

   CWE-434

8. A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.CVE-2022-40407Chamilo · CVSS 8.8 · 1.7% likely

   CWE-434

9. Chamilo LMS CStudio upload flow allows unauthenticated remote code executionCVE-2026-45140chamilo · CVSS 9.8 · 1.3% likely

   CWE-22

10. An arbitrary file upload vulnerability in the /fileUpload.lib.php component of Chamilo 1.11.* up to v1.11.18 allows attackers to execute arbitrary code via uploading a crafted SVG…CVE-2023-34944Chamilo · 1.1% likely

    CWE-434

11. Chamilo 1.11.16 is affected by an authenticated local file inclusion vulnerability which allows authenticated users with access to 'big file uploads' to copy/move files from anywh…CVE-2022-42029Chamilo · CVSS 8.8 · 0.9% likely

    CWE-434

12. Chamilo: Authenticated Remote Code Execution via Unrestricted File UploadCVE-2026-29041chamilo · CVSS 8.8 · 0.8% likely

    CWE-434

13. Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCECVE-2026-32931chamilo · CVSS 7.5 · 0.5% likely

    CWE-434

14. Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointCVE-2026-33704chamilo · CVSS 7.1 · 0.4% likely

    CWE-434

15. Chamilo LMS 1.11.8 Arbitrary File Upload via elfinderCVE-2018-25158Chamilo · CVSS 8.8 · 0.4% likely

    CWE-434

16. Path Traversal (Arbitrary File Delete) in Chamilo LMSCVE-2026-31939chamilo · CVSS 8.3 · 0.4% likely

    CWE-22

17. Chamilo LMS affected by unauthenticated RCE in main/install folderCVE-2026-33698chamilo · CVSS 9.3 · 0.3% likely

    CWE-552

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.