← Database

CVE-2026-31940

HIGH CVSS: 7.5 Published: 2026-04-10 Modified: 2026-06-17

Description

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to set the PHP session ID before loading global bootstrap. This leads to session fixation. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

Affected Platforms

Chamilo Chamilo Lms

Weakness Type

CWE-384

References