CVE-2022-40407

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2022-09-29

Last modified

2025-05-20

Weaknesses

CWE-434

Affected products

• Chamilo (Chamilo)

References

• https://github.com/alexmackey/security-research/blob/main/chamilo/ChamiloRceViaZipSlip.md
• https://github.com/chamilo/chamilo-lms
• https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-94-2022-09-06-High-impact-Moderate-risk-Auth…