Summary
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
Advisory details
Impact
Ability to run arbitrary code on the server without authentication.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-105677
Ghost: Remote Code Execution via Theme Translation Files
- HIGHCVE-2026-77271
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)
- HIGHCVE-2026-82393
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
- MEDIUMCVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
- MEDIUMCVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
- HIGHCVE-2026-102870
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability